CVE-2023-52139: Improper Authorization (CWE-285)
value: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.6
Published: 2023-12-29T18:15Z
Repository: https://github.com/misskey-dev/misskey
Language: TypeScript
Files changed: CHANGELOG.md, locales/index.d.ts, locales/ja-JP.yml, packages/backend/src/server/api/ApiCallService.ts, packages/backend/src/server/api/StreamingApiServerService.ts, packages/backend/src/server/api/endpoints.ts, packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts, packages/backend/src/server/api/endpoints/admin/accounts/create.ts, packages/backend/src/server/api/endpoints/admin/accounts/delete.ts, packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts, packages/backend/src/server/api/endpoints/admin/ad/create.ts, packages/backend/src/server/api/endpoints/admin/ad/delete.ts, packages/backend/src/server/api/endpoints/admin/ad/list.ts, packages/backend/src/server/api/endpoints/admin/ad/update.ts, packages/backend/src/server/api/endpoints/admin/announcements/create.ts, packages/backend/src/server/api/endpoints/admin/announcements/delete.ts, packages/backend/src/server/api/endpoints/admin/announcements/list.ts, packages/backend/src/server/api/endpoints/admin/announcements/update.ts, packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts, packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts, packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts, packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts, packages/backend/src/server/api/endpoints/admin/delete-account.ts, packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts, packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts, packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts, packages/backend/src/server/api/endpoints/admin/drive/files.ts, packages/backend/src/server/api/endpoints/admin/drive/show-file.ts, packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/add.ts, packages/backend/src/server/api/endpoints/admin/emoji/copy.ts, packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/delete.ts, packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts, packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts, packages/backend/src/server/api/endpoints/admin/emoji/list.ts, packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts, packages/backend/src/server/api/endpoints/admin/emoji/update.ts, packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts, packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts, packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts, packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts, packages/backend/src/server/api/endpoints/admin/get-index-stats.ts, packages/backend/src/server/api/endpoints/admin/get-table-stats.ts, packages/backend/src/server/api/endpoints/admin/get-user-ips.ts, packages/backend/src/server/api/endpoints/admin/invite/create.ts, packages/backend/src/server/api/endpoints/admin/invite/list.ts, packages/backend/src/server/api/endpoints/admin/meta.ts, packages/backend/src/server/api/endpoints/admin/promo/create.ts, packages/backend/src/server/api/endpoints/admin/queue/clear.ts, packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts, packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts, packages/backend/src/server/api/endpoints/admin/queue/promote.ts, packages/backend/src/server/api/endpoints/admin/queue/stats.ts, packages/backend/src/server/api/endpoints/admin/relays/add.ts, packages/backend/src/server/api/endpoints/admin/relays/list.ts, packages/backend/src/server/api/endpoints/admin/relays/remove.ts, packages/backend/src/server/api/endpoints/admin/reset-password.ts, packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts, packages/backend/src/server/api/endpoints/admin/roles/assign.ts, packages/backend/src/server/api/endpoints/admin/roles/create.ts, packages/backend/src/server/api/endpoints/admin/roles/delete.ts, packages/backend/src/server/api/endpoints/admin/roles/list.ts, packages/backend/src/server/api/endpoints/admin/roles/show.ts, packages/backend/src/server/api/endpoints/admin/roles/unassign.ts, packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts, packages/backend/src/server/api/endpoints/admin/roles/update.ts, packages/backend/src/server/api/endpoints/admin/roles/users.ts, packages/backend/src/server/api/endpoints/admin/send-email.ts, packages/backend/src/server/api/endpoints/admin/server-info.ts, packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts, packages/backend/src/server/api/endpoints/admin/show-user.ts, packages/backend/src/server/api/endpoints/admin/show-users.ts, packages/backend/src/server/api/endpoints/admin/suspend-user.ts, packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts, packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts, packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts, packages/backend/src/server/api/endpoints/admin/update-meta.ts, packages/backend/src/server/api/endpoints/admin/update-user-note.ts, packages/backend/src/server/api/endpoints/ap/get.ts, packages/backend/src/server/api/endpoints/ap/show.ts, packages/backend/src/server/api/endpoints/federation/update-remote-user.ts, packages/backend/src/server/api/endpoints/fetch-external-resources.ts, packages/backend/src/server/api/endpoints/i.ts, packages/backend/src/server/api/endpoints/i/claim-achievement.ts, packages/backend/src/server/api/endpoints/i/registry/get-all.ts, packages/backend/src/server/api/endpoints/i/registry/get-detail.ts, packages/backend/src/server/api/endpoints/i/registry/get.ts, packages/backend/src/server/api/endpoints/i/registry/keys-with-type.ts, packages/backend/src/server/api/endpoints/i/registry/keys.ts, packages/backend/src/server/api/endpoints/i/registry/remove.ts, packages/backend/src/server/api/endpoints/i/registry/set.ts, packages/backend/src/server/api/endpoints/invite/create.ts, packages/backend/src/server/api/endpoints/invite/delete.ts, packages/backend/src/server/api/endpoints/invite/limit.ts, packages/backend/src/server/api/endpoints/invite/list.ts, packages/backend/src/server/api/endpoints/my/apps.ts, packages/backend/src/server/api/endpoints/notes/hybrid-timeline.ts, packages/backend/src/server/api/endpoints/notes/mentions.ts, packages/backend/src/server/api/endpoints/notes/polls/recommendation.ts, packages/backend/src/server/api/endpoints/notes/state.ts, packages/backend/src/server/api/endpoints/notes/timeline.ts, packages/backend/src/server/api/endpoints/notes/translate.ts, packages/backend/src/server/api/endpoints/notes/user-list-timeline.ts, packages/backend/src/server/api/endpoints/promo/read.ts, packages/backend/src/server/api/endpoints/roles/list.ts, packages/backend/src/server/api/endpoints/roles/notes.ts, packages/backend/src/server/api/endpoints/sw/register.ts, packages/backend/src/server/api/endpoints/sw/show-registration.ts, packages/backend/src/server/api/endpoints/sw/update-registration.ts, packages/backend/src/server/api/endpoints/users/achievements.ts, packages/backend/src/server/api/endpoints/users/lists/create-from-public.ts, packages/backend/src/server/api/endpoints/users/lists/favorite.ts, packages/backend/src/server/api/endpoints/users/lists/unfavorite.ts, packages/backend/src/server/api/endpoints/users/relation.ts, packages/backend/src/server/api/endpoints/users/report-abuse.ts, packages/backend/src/server/api/stream/ChannelsService.ts, packages/backend/src/server/api/stream/Connection.ts, packages/backend/src/server/api/stream/channel.ts, packages/backend/src/server/api/stream/channels/admin.ts, packages/backend/src/server/api/stream/channels/antenna.ts, packages/backend/src/server/api/stream/channels/channel.ts, packages/backend/src/server/api/stream/channels/drive.ts, packages/backend/src/server/api/stream/channels/global-timeline.ts, packages/backend/src/server/api/stream/channels/hashtag.ts, packages/backend/src/server/api/stream/channels/home-timeline.ts, packages/backend/src/server/api/stream/channels/hybrid-timeline.ts, packages/backend/src/server/api/stream/channels/local-timeline.ts, packages/backend/src/server/api/stream/channels/main.ts, packages/backend/src/server/api/stream/channels/queue-stats.ts, packages/backend/src/server/api/stream/channels/role-timeline.ts, packages/backend/src/server/api/stream/channels/server-stats.ts, packages/backend/src/server/api/stream/channels/user-list.ts, packages/backend/src/server/oauth/OAuth2ProviderService.ts, packages/backend/test/e2e/api.ts, packages/backend/test/e2e/streaming.ts, packages/backend/test/utils.ts, packages/frontend/src/components/MkTokenGenerateWindow.vue, packages/misskey-js/src/autogen/apiClientJSDoc.ts, packages/misskey-js/src/autogen/endpoint.ts, packages/misskey-js/src/autogen/entities.ts, packages/misskey-js/src/autogen/models.ts, packages/misskey-js/src/autogen/types.ts, packages/misskey-js/src/consts.ts
Commit date: 2023-12-27 15:08:59 +0900
Commit message: Merge pull request from GHSA-7pxq-6xx9-xpgm

* fix: fix improper authorization when accessing with third-party application

* refactor: refactor type definitions

* fix: get rid of unnecessary access limitation

* enhance: サードパーティアプリケーションがWebsocket APIを使えるように

* fix: add missing parentheses

* Revert "fix(backend): add missing kind definition for admin endpoints to improve security"

This reverts commit 5150053275594278e9eb23e72d98b16593c4c230.

* frontend: 翻訳の抜けを訂正, read:adminとwrite:adminはアクセス発行トークンのデフォルトでは非表示にする

* enhance(test): misskey-ghsa-7pxq-6xx9-xpgmに関するテストを追加

* enhance(test): Websocket APIに対するテストも追加

* enhance(refactor): `@/misc/api-permissions.ts`を`misskey-js/permissions`に統合

* fix(frontend): アクセストークン発行UIで全ての権限を有効にした際、管理者用APIへのアクセスも許可してしまう問題を修正

* enhance(backend): Websocketの接続に最低限必要な権限を変更

* fix(backend): `/api/admin/meta`をサードパーティアプリケーションからはアクセスできないように

* fix(backend): エンドポイントにアクセスするために必要な権限を変更

* fix(frontend/locale): Add missing type declaration

* chore: update `misskey-js/src/autogen`

---------

Co-authored-by: tamaina <tamaina@hotmail.co.jp>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52f5c07ab31..8b71f6540dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -130,11 +130,10 @@
 - Fix: 「みつける」が年越し時に壊れる問題を修正
 - Fix: アカウントをブロックした際に、自身のユーザーのページでノートが相手に表示される問題を修正
 - Fix: モデレーションログがモデレーターは閲覧できないように修正
 - Fix: ハッシュタグのトレンド除外設定が即時に効果を持つように修正
 - Fix: HTTP Digestヘッダのアルゴリズム部分に大文字の"SHA-256"しか使えない
-- Fix: 管理者用APIのアクセス権限が適切に設定されていない問題を修正
 
 ## 2023.11.1
 
 ### Note
 - 悪意のある第三者がリモートユーザーになりすました任意のアクティビティを受け取れてしまう問題を修正しました。詳しくは[GitHub security advisory](https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc)をご覧ください。
diff --git a/locales/index.d.ts b/locales/index.d.ts
index b3589082e1c..89bdddbdcf9 100644
--- a/locales/index.d.ts
+++ b/locales/index.d.ts
@@ -2064,10 +2064,59 @@ export interface Locale {
         "write:gallery-likes": string;
         "read:flash": string;
         "write:flash": string;
         "read:flash-likes": string;
         "write:flash-likes": string;
+        "read:admin:abuse-user-reports": string;
+        "write:admin:delete-account": string;
+        "write:admin:delete-all-files-of-a-user": string;
+        "read:admin:index-stats": string;
+        "read:admin:table-stats": string;
+        "read:admin:user-ips": string;
+        "read:admin:meta": string;
+        "write:admin:reset-password": string;
+        "write:admin:resolve-abuse-user-report": string;
+        "write:admin:send-email": string;
+        "read:admin:server-info": string;
+        "read:admin:show-moderation-log": string;
+        "read:admin:show-user": string;
+        "read:admin:show-users": string;
+        "write:admin:suspend-user": string;
+        "write:admin:unset-user-avatar": string;
+        "write:admin:unset-user-banner": string;
+        "write:admin:unsuspend-user": string;
+        "write:admin:meta": string;
+        "write:admin:user-note": string;
+        "write:admin:roles": string;
+        "read:admin:roles": string;
+        "write:admin:relays": string;
+        "read:admin:relays": string;
+        "write:admin:invite-codes": string;
+        "read:admin:invite-codes": string;
+        "write:admin:announcements": string;
+        "read:admin:announcements": string;
+        "write:admin:avatar-decorations": string;
+        "read:admin:avatar-decorations": string;
+        "write:admin:federation": string;
+        "write:admin:account": string;
+        "read:admin:account": string;
+        "write:admin:emoji": string;
+        "read:admin:emoji": string;
+        "write:admin:queue": string;
+        "read:admin:queue": string;
+        "write:admin:promo": string;
+        "write:admin:drive": string;
+        "read:admin:drive": string;
+        "read:admin:stream": string;
+        "write:admin:ad": string;
+        "read:admin:ad": string;
+        "write:invite-codes": string;
+        "read:invite-codes": string;
+        "write:clip-favorite": string;
+        "read:clip-favorite": string;
+        "read:federation": string;
+        "write:report-abuse": string;
     };
     "_auth": {
         "shareAccessTitle": string;
         "shareAccess": string;
         "shareAccessAsk": string;
diff --git a/locales/ja-JP.yml b/locales/ja-JP.yml
index b59fb6e7491..7bc5889297b 100644
--- a/locales/ja-JP.yml
+++ b/locales/ja-JP.yml
@@ -1969,10 +1969,59 @@ _permissions:
   "write:gallery-likes": "ギャラリーのいいねを操作する"
   "read:flash": "Playを見る"
   "write:flash": "Playを操作する"
   "read:flash-likes": "Playのいいねを見る"
   "write:flash-likes": "Playのいいねを操作する"
+  "read:admin:abuse-user-reports": "ユーザーからの通報を見る"
+  "write:admin:delete-account": "ユーザーアカウントを削除する"
+  "write:admin:delete-all-files-of-a-user": "ユーザーのすべてのファイルを削除する"
+  "read:admin:index-stats": "データベースインデックスに関する情報を見る"
+  "read:admin:table-stats": "データベーステーブルに関する情報を見る"
+  "read:admin:user-ips": "ユーザーのIPアドレスを見る"
+  "read:admin:meta": "インスタンスのメタデータを見る"
+  "write:admin:reset-password": "ユーザーのパスワードをリセットする"
+  "write:admin:resolve-abuse-user-report": "ユーザーからの通報を解決する"
+  "write:admin:send-email": "メールを送る"
+  "read:admin:server-info": "サーバーの情報を見る"
+  "read:admin:show-moderation-log": "モデレーションログを見る"
+  "read:admin:show-user": "ユーザーのプライベートな情報を見る"
+  "read:admin:show-users": "ユーザーのプライベートな情報を見る"
+  "write:admin:suspend-user": "ユーザーを凍結する"
+  "write:admin:unset-user-avatar": "ユーザーのアバターを削除する"
+  "write:admin:unset-user-banner": "ユーザーのバーナーを削除する"
+  "write:admin:unsuspend-user": "ユーザーの凍結を解除する"
+  "write:admin:meta": "インスタンスのメタデータを操作する"
+  "write:admin:user-note": "モデレーションノートを操作する"
+  "write:admin:roles": "ロールを操作する"
+  "read:admin:roles": "ロールを見る"
+  "write:admin:relays": "リレーを操作する"
+  "read:admin:relays": "リレーを見る"
+  "write:admin:invite-codes": "招待コードを操作する"
+  "read:admin:invite-codes": "招待コードを見る"
+  "write:admin:announcements": "お知らせを操作する"
+  "read:admin:announcements": "お知らせを見る"
+  "write:admin:avatar-decorations": "アバターデコレーションを操作する"
+  "read:admin:avatar-decorations": "アバターデコレーションを見る"
+  "write:admin:federation": "連合に関する情報を操作する"
+  "write:admin:account": "ユーザーアカウントを操作する"
+  "read:admin:account": "ユーザーに関する情報を見る"
+  "write:admin:emoji": "絵文字を操作する"
+  "read:admin:emoji": "絵文字を見る"
+  "write:admin:queue": "ジョブキューを操作する"
+  "read:admin:queue": "ジョブキューに関する情報を見る"
+  "write:admin:promo": "プロモーションノートを操作する"
+  "write:admin:drive": "ユーザーのドライブを操作する"
+  "read:admin:drive": "ユーザーのドライブの関する情報を見る"
+  "read:admin:stream": "管理者用のWebsocket APIを使う"
+  "write:admin:ad": "広告を操作する"
+  "read:admin:ad": "広告を見る"
+  "write:invite-codes": "招待コードを作成する"
+  "read:invite-codes": "招待コードを取得する"
+  "write:clip-favorite": "クリップのいいねを操作する"
+  "read:clip-favorite": "クリップのいいねを見る"
+  "read:federation": "連合に関する情報を取得する"
+  "write:report-abuse": "違反を報告する"
 
 _auth:
   shareAccessTitle: "アプリへのアクセス許可"
   shareAccess: "「{name}」がアカウントにアクセスすることを許可しますか？"
   shareAccessAsk: "アカウントへのアクセスを許可しますか？"
diff --git a/packages/backend/src/misc/api-permissions.ts b/packages/backend/src/misc/api-permissions.ts
deleted file mode 100644
index 57c93088445..00000000000
--- a/packages/backend/src/misc/api-permissions.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and other misskey contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-export const kinds = [
-	'read:account',
-	'write:account',
-	'read:blocks',
-	'write:blocks',
-	'read:drive',
-	'write:drive',
-	'read:favorites',
-	'write:favorites',
-	'read:following',
-	'write:following',
-	'read:messaging',
-	'write:messaging',
-	'read:mutes',
-	'write:mutes',
-	'write:notes',
-	'read:notifications',
-	'write:notifications',
-	'read:reactions',
-	'write:reactions',
-	'write:votes',
-	'read:pages',
-	'write:pages',
-	'write:page-likes',
-	'read:page-likes',
-	'read:user-groups',
-	'write:user-groups',
-	'read:channels',
-	'write:channels',
-	'read:gallery',
-	'write:gallery',
-	'read:gallery-likes',
-	'write:gallery-likes',
-];
-// IF YOU ADD KINDS(PERMISSIONS), YOU MUST ADD TRANSLATIONS (under _permissions).
diff --git a/packages/backend/src/server/api/ApiCallService.ts b/packages/backend/src/server/api/ApiCallService.ts
index 66f171a5d8f..56f804dee8c 100644
--- a/packages/backend/src/server/api/ApiCallService.ts
+++ b/packages/backend/src/server/api/ApiCallService.ts
@@ -328,11 +328,12 @@ export class ApiCallService implements OnApplicationShutdown {
 					id: '7f86f06f-7e15-4057-8561-f4b6d4ac755a',
 				});
 			}
 		}
 
-		if (token && ep.meta.kind && !token.permission.some(p => p === ep.meta.kind)) {
+		if (token && ((ep.meta.kind && !token.permission.some(p => p === ep.meta.kind))
+			|| (!ep.meta.kind && (ep.meta.requireCredential || ep.meta.requireModerator || ep.meta.requireAdmin)))) {
 			throw new ApiError({
 				message: 'Your app does not have the necessary permissions to use this endpoint.',
 				code: 'PERMISSION_DENIED',
 				kind: 'permission',
 				id: '1370e5b7-d4eb-4566-bb1d-7748ee6a1838',
diff --git a/packages/backend/src/server/api/StreamingApiServerService.ts b/packages/backend/src/server/api/StreamingApiServerService.ts
index dc3a00617cc..3b387d92ca1 100644
--- a/packages/backend/src/server/api/StreamingApiServerService.ts
+++ b/packages/backend/src/server/api/StreamingApiServerService.ts
@@ -69,10 +69,14 @@ export class StreamingApiServerService {
 				? request.headers.authorization.slice(7)
 				: q.get('i');
 
 			try {
 				[user, app] = await this.authenticateService.authenticate(token);
+
+				if (app !== null && !app.permission.some(p => p === 'read:account')) {
+					throw new AuthenticationError('Your app does not have necessary permissions to use websocket API.');
+				}
 			} catch (e) {
 				if (e instanceof AuthenticationError) {
 					socket.write([
 						'HTTP/1.1 401 Unauthorized',
 						'WWW-Authenticate: Bearer realm="Misskey", error="invalid_token", error_description="Failed to authenticate"',
diff --git a/packages/backend/src/server/api/endpoints.ts b/packages/backend/src/server/api/endpoints.ts
index e458d720abe..41232091c61 100644
--- a/packages/backend/src/server/api/endpoints.ts
+++ b/packages/backend/src/server/api/endpoints.ts
@@ -2,10 +2,11 @@
  * SPDX-FileCopyrightText: syuilo and other misskey contributors
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
 import type { Schema } from '@/misc/json-schema.js';
+import { permissions } from 'misskey-js';
 import { RolePolicies } from '@/core/RoleService.js';
 
 import * as ep___admin_meta from './endpoints/admin/meta.js';
 import * as ep___admin_abuseUserReports from './endpoints/admin/abuse-user-reports.js';
 import * as ep___admin_accounts_create from './endpoints/admin/accounts/create.js';
@@ -722,11 +723,11 @@ const eps = [
 	['fetch-rss', ep___fetchRss],
 	['fetch-external-resources', ep___fetchExternalResources],
 	['retention', ep___retention],
 ];
 
-export interface IEndpointMeta {
+interface IEndpointMetaBase {
 	readonly stability?: 'deprecated' | 'experimental' | 'stable';
 
 	readonly tags?: ReadonlyArray<string>;
 
 	readonly errors?: {
@@ -821,10 +822,27 @@ export interface IEndpointMeta {
 	 * 正常応答をキャッシュ (Cache-Control: public) する秒数
 	 */
 	readonly cacheSec?: number;
 }
 
+export type IEndpointMeta = (Omit<IEndpointMetaBase, 'requireCrential' | 'requireModerator' | 'requireAdmin'> & {
+	requireCredential?: false,
+	requireAdmin?: false,
+	requireModerator?: false,
+}) | (Omit<IEndpointMetaBase, 'secure'> & {
+	secure: true,
+}) | (Omit<IEndpointMetaBase, 'requireCredential' | 'kind'> & {
+	requireCredential: true,
+	kind: (typeof permissions)[number],
+}) | (Omit<IEndpointMetaBase, 'requireModerator' | 'kind'> & {
+	requireModerator: true,
+	kind: (typeof permissions)[number],
+}) | (Omit<IEndpointMetaBase, 'requireAdmin' | 'kind'> & {
+	requireAdmin: true,
+	kind: (typeof permissions)[number],
+})
+
 export interface IEndpoint {
 	name: string;
 	meta: IEndpointMeta;
 	params: Schema;
 }
diff --git a/packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts b/packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts
index 484118cd463..3484d6707a3 100644
--- a/packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts
+++ b/packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { AbuseUserReportEntityService } from '@/core/entities/AbuseUserReportEntityService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:abuse-user-reports',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/accounts/create.ts b/packages/backend/src/server/api/endpoints/admin/accounts/create.ts
index 07f24d2995c..a2f9bf69454 100644
--- a/packages/backend/src/server/api/endpoints/admin/accounts/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/accounts/create.ts
@@ -13,11 +13,11 @@ import { localUsernameSchema, passwordSchema } from '@/models/User.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
+	secure: true,
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		ref: 'User',
diff --git a/packages/backend/src/server/api/endpoints/admin/accounts/delete.ts b/packages/backend/src/server/api/endpoints/admin/accounts/delete.ts
index 86f4b0709b9..52d8c8ce18f 100644
--- a/packages/backend/src/server/api/endpoints/admin/accounts/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/accounts/delete.ts
@@ -12,14 +12,13 @@ import { DI } from '@/di-symbols.js';
 import { UserEntityService } from '@/core/entities/UserEntityService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:account',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts b/packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts
index bc292fd53a4..93673453d62 100644
--- a/packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts
+++ b/packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts
@@ -11,14 +11,13 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js';
 import { ApiError } from '@/server/api/error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'read:admin:account',
 
 	errors: {
 		userNotFound: {
 			message: 'No such user who has the email address.',
 			code: 'USER_NOT_FOUND',
diff --git a/packages/backend/src/server/api/endpoints/admin/ad/create.ts b/packages/backend/src/server/api/endpoints/admin/ad/create.ts
index 087ae4befc0..041b10f9f79 100644
--- a/packages/backend/src/server/api/endpoints/admin/ad/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/ad/create.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 	res: {
 		type: 'object',
 		optional: false,
 		nullable: false,
 		ref: 'Ad',
diff --git a/packages/backend/src/server/api/endpoints/admin/ad/delete.ts b/packages/backend/src/server/api/endpoints/admin/ad/delete.ts
index ba655a6aa35..5b18b347d33 100644
--- a/packages/backend/src/server/api/endpoints/admin/ad/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/ad/delete.ts
@@ -11,14 +11,13 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 
 	errors: {
 		noSuchAd: {
 			message: 'No such ad.',
 			code: 'NO_SUCH_AD',
diff --git a/packages/backend/src/server/api/endpoints/admin/ad/list.ts b/packages/backend/src/server/api/endpoints/admin/ad/list.ts
index 12528917dc3..586c1f44db4 100644
--- a/packages/backend/src/server/api/endpoints/admin/ad/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/ad/list.ts
@@ -10,14 +10,13 @@ import { QueryService } from '@/core/QueryService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:ad',
 	res: {
 		type: 'array',
 		optional: false,
 		nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/ad/update.ts b/packages/backend/src/server/api/endpoints/admin/ad/update.ts
index b83c163004d..bf96e44b0c7 100644
--- a/packages/backend/src/server/api/endpoints/admin/ad/update.ts
+++ b/packages/backend/src/server/api/endpoints/admin/ad/update.ts
@@ -11,14 +11,13 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 
 	errors: {
 		noSuchAd: {
 			message: 'No such ad.',
 			code: 'NO_SUCH_AD',
diff --git a/packages/backend/src/server/api/endpoints/admin/announcements/create.ts b/packages/backend/src/server/api/endpoints/admin/announcements/create.ts
index fb432336e45..c9df70c76b7 100644
--- a/packages/backend/src/server/api/endpoints/admin/announcements/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/announcements/create.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { AnnouncementService } from '@/core/AnnouncementService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/announcements/delete.ts b/packages/backend/src/server/api/endpoints/admin/announcements/delete.ts
index e84e63c666d..939333345ea 100644
--- a/packages/backend/src/server/api/endpoints/admin/announcements/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/announcements/delete.ts
@@ -11,14 +11,13 @@ import { AnnouncementService } from '@/core/AnnouncementService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	errors: {
 		noSuchAnnouncement: {
 			message: 'No such announcement.',
 			code: 'NO_SUCH_ANNOUNCEMENT',
diff --git a/packages/backend/src/server/api/endpoints/admin/announcements/list.ts b/packages/backend/src/server/api/endpoints/admin/announcements/list.ts
index e98ef0b1692..429b1385991 100644
--- a/packages/backend/src/server/api/endpoints/admin/announcements/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/announcements/list.ts
@@ -12,14 +12,13 @@ import { DI } from '@/di-symbols.js';
 import { IdService } from '@/core/IdService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:announcements',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/announcements/update.ts b/packages/backend/src/server/api/endpoints/admin/announcements/update.ts
index e2ec344899a..db6db8356df 100644
--- a/packages/backend/src/server/api/endpoints/admin/announcements/update.ts
+++ b/packages/backend/src/server/api/endpoints/admin/announcements/update.ts
@@ -11,14 +11,13 @@ import { AnnouncementService } from '@/core/AnnouncementService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	errors: {
 		noSuchAnnouncement: {
 			message: 'No such announcement.',
 			code: 'NO_SUCH_ANNOUNCEMENT',
diff --git a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts
index 158435ed21a..4ac74253ccf 100644
--- a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts
index 06083cc1802..88977f801af 100644
--- a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts
@@ -10,14 +10,13 @@ import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 	errors: {
 	},
 } as const;
 
 export const paramDef = {
diff --git a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts
index 49a8718bce0..33122c3eef0 100644
--- a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts
@@ -13,14 +13,13 @@ import { IdService } from '@/core/IdService.js';
 import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'read:admin:avatar-decorations',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts
index 3d8f3d63de0..6211345f963 100644
--- a/packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts
+++ b/packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts
@@ -10,14 +10,13 @@ import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 
 	errors: {
 	},
 } as const;
 
diff --git a/packages/backend/src/server/api/endpoints/admin/delete-account.ts b/packages/backend/src/server/api/endpoints/admin/delete-account.ts
index adc446d14b0..2c82c2879d5 100644
--- a/packages/backend/src/server/api/endpoints/admin/delete-account.ts
+++ b/packages/backend/src/server/api/endpoints/admin/delete-account.ts
@@ -10,14 +10,13 @@ import { DeleteAccountService } from '@/core/DeleteAccountService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:delete-account',
 
 	res: {
 	},
 } as const;
 
diff --git a/packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts b/packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts
index 1fdbbfb12e6..7d33065f2e5 100644
--- a/packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts
+++ b/packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts
@@ -10,14 +10,13 @@ import { DriveService } from '@/core/DriveService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:delete-all-files-of-a-user',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts b/packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts
index 3f23319a5f8..af2bb6b1cae 100644
--- a/packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts
+++ b/packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:drive',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {},
diff --git a/packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts b/packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts
index fd8fa46a475..a3b221284b7 100644
--- a/packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts
+++ b/packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts
@@ -11,14 +11,13 @@ import { DriveService } from '@/core/DriveService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:drive',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {},
diff --git a/packages/backend/src/server/api/endpoints/admin/drive/files.ts b/packages/backend/src/server/api/endpoints/admin/drive/files.ts
index 816bbfbc45b..37fa439bcf0 100644
--- a/packages/backend/src/server/api/endpoints/admin/drive/files.ts
+++ b/packages/backend/src/server/api/endpoints/admin/drive/files.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { DriveFileEntityService } from '@/core/entities/DriveFileEntityService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:drive',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/drive/show-file.ts b/packages/backend/src/server/api/endpoints/admin/drive/show-file.ts
index 61cb8435586..3aeb3e45e33 100644
--- a/packages/backend/src/server/api/endpoints/admin/drive/show-file.ts
+++ b/packages/backend/src/server/api/endpoints/admin/drive/show-file.ts
@@ -12,14 +12,13 @@ import { IdService } from '@/core/IdService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:drive',
 
 	errors: {
 		noSuchFile: {
 			message: 'No such file.',
 			code: 'NO_SUCH_FILE',
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts
index 5333adb6245..1cd8125c526 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/add.ts b/packages/backend/src/server/api/endpoints/admin/emoji/add.ts
index 76ff1c6b942..4a9418d0513 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/add.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/add.ts
@@ -12,14 +12,13 @@ import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchFile: {
 			message: 'No such file.',
 			code: 'NO_SUCH_FILE',
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/copy.ts b/packages/backend/src/server/api/endpoints/admin/emoji/copy.ts
index 87260faa43f..476780b23f4 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/copy.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/copy.ts
@@ -14,14 +14,13 @@ import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {
 			message: 'No such emoji.',
 			code: 'NO_SUCH_EMOJI',
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts
index c483794a40b..450695984a7 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/delete.ts b/packages/backend/src/server/api/endpoints/admin/emoji/delete.ts
index e15af7717bd..e1e6e7c2c4a 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/delete.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {
 			message: 'No such emoji.',
 			code: 'NO_SUCH_EMOJI',
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts b/packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts
index b75616f3cc0..208616c0ac3 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts
@@ -6,11 +6,11 @@
 import { Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
-	kind: 'write:admin',
+	secure: true,
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
 } as const;
 
 export const paramDef = {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts b/packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts
index a383e093389..f3e0c1ef1f2 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts
@@ -13,14 +13,13 @@ import { DI } from '@/di-symbols.js';
 import { sqlLikeEscape } from '@/misc/sql-like-escape.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/list.ts b/packages/backend/src/server/api/endpoints/admin/emoji/list.ts
index 210b3639c35..59e87253f6f 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/list.ts
@@ -13,14 +13,13 @@ import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js';
 //import { sqlLikeEscape } from '@/misc/sql-like-escape.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts
index 8e92db1dafe..26dd43e9262 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts
index 5a06b5b32fe..18961976f9c 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts
index b3e9c6df13f..c680f2e2d49 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts b/packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts
index c59d13ad16d..47c692b6137 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/emoji/update.ts b/packages/backend/src/server/api/endpoints/admin/emoji/update.ts
index 61d857b7b0e..550bb0052bb 100644
--- a/packages/backend/src/server/api/endpoints/admin/emoji/update.ts
+++ b/packages/backend/src/server/api/endpoints/admin/emoji/update.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {
 			message: 'No such emoji.',
 			code: 'NO_SUCH_EMOJI',
diff --git a/packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts b/packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts
index b81297413c0..57612850b4d 100644
--- a/packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts
+++ b/packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts
@@ -10,14 +10,13 @@ import { DriveService } from '@/core/DriveService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts b/packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts
index 6cc4e3087fa..0d061c685f7 100644
--- a/packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts
+++ b/packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts
@@ -11,14 +11,13 @@ import { UtilityService } from '@/core/UtilityService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts b/packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts
index 18884dfca66..c15fb83454e 100644
--- a/packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts
+++ b/packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts b/packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts
index 4232d42ba54..f429949e16a 100644
--- a/packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts
+++ b/packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts
@@ -12,14 +12,13 @@ import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/get-index-stats.ts b/packages/backend/src/server/api/endpoints/admin/get-index-stats.ts
index b81d9857d70..0b50212119d 100644
--- a/packages/backend/src/server/api/endpoints/admin/get-index-stats.ts
+++ b/packages/backend/src/server/api/endpoints/admin/get-index-stats.ts
@@ -9,12 +9,11 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	requireCredential: true,
 	requireAdmin: true,
-
-	kind: 'read:admin',
+	kind: 'read:admin:index-stats',
 
 	tags: ['admin'],
 	res: {
 		type: 'array',
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/get-table-stats.ts b/packages/backend/src/server/api/endpoints/admin/get-table-stats.ts
index c104f653efb..0d44b288cb8 100644
--- a/packages/backend/src/server/api/endpoints/admin/get-table-stats.ts
+++ b/packages/backend/src/server/api/endpoints/admin/get-table-stats.ts
@@ -9,12 +9,11 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	requireCredential: true,
 	requireAdmin: true,
-
-	kind: 'read:admin',
+	kind: 'read:admin:table-stats',
 
 	tags: ['admin'],
 
 	res: {
 		type: 'object',
diff --git a/packages/backend/src/server/api/endpoints/admin/get-user-ips.ts b/packages/backend/src/server/api/endpoints/admin/get-user-ips.ts
index 76c32f2a9f3..1b437f718ba 100644
--- a/packages/backend/src/server/api/endpoints/admin/get-user-ips.ts
+++ b/packages/backend/src/server/api/endpoints/admin/get-user-ips.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { IdService } from '@/core/IdService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:user-ips',
 	res: {
 		type: 'array',
 		optional: false,
 		nullable: false,
 		items: {
@@ -32,11 +31,11 @@ export const meta = {
 					nullable: false,
 					format: 'date-time',
 				},
 			},
 		},
-	}
+	},
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/invite/create.ts b/packages/backend/src/server/api/endpoints/admin/invite/create.ts
index 96de772edc1..396b84623f2 100644
--- a/packages/backend/src/server/api/endpoints/admin/invite/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/invite/create.ts
@@ -14,14 +14,13 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:invite-codes',
 
 	errors: {
 		invalidDateTime: {
 			message: 'Invalid date-time format',
 			code: 'INVALID_DATE_TIME',
diff --git a/packages/backend/src/server/api/endpoints/admin/invite/list.ts b/packages/backend/src/server/api/endpoints/admin/invite/list.ts
index 3b7dc72e111..d293dcadc62 100644
--- a/packages/backend/src/server/api/endpoints/admin/invite/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/invite/list.ts
@@ -10,14 +10,13 @@ import { InviteCodeEntityService } from '@/core/entities/InviteCodeEntityService
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:invite-codes',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/meta.ts b/packages/backend/src/server/api/endpoints/admin/meta.ts
index eef27b97211..febc4ab1b17 100644
--- a/packages/backend/src/server/api/endpoints/admin/meta.ts
+++ b/packages/backend/src/server/api/endpoints/admin/meta.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { DEFAULT_POLICIES } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['meta'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'read:admin:meta',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/promo/create.ts b/packages/backend/src/server/api/endpoints/admin/promo/create.ts
index e2befec50fe..ab69dfba963 100644
--- a/packages/backend/src/server/api/endpoints/admin/promo/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/promo/create.ts
@@ -11,14 +11,13 @@ import { DI } from '@/di-symbols.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:promo',
 
 	errors: {
 		noSuchNote: {
 			message: 'No such note.',
 			code: 'NO_SUCH_NOTE',
diff --git a/packages/backend/src/server/api/endpoints/admin/queue/clear.ts b/packages/backend/src/server/api/endpoints/admin/queue/clear.ts
index 1d565e8f244..9912043c8b9 100644
--- a/packages/backend/src/server/api/endpoints/admin/queue/clear.ts
+++ b/packages/backend/src/server/api/endpoints/admin/queue/clear.ts
@@ -9,14 +9,13 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:queue',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {},
diff --git a/packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts b/packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts
index 30005fc6666..84739091038 100644
--- a/packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts
+++ b/packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts
@@ -9,14 +9,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import type { DeliverQueue } from '@/core/QueueModule.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:queue',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts b/packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts
index aa8b6edee58..19f7cb85c05 100644
--- a/packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts
+++ b/packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts
@@ -9,14 +9,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import type { InboxQueue } from '@/core/QueueModule.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:queue',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/queue/promote.ts b/packages/backend/src/server/api/endpoints/admin/queue/promote.ts
index 8f46cd63752..d06780e0442 100644
--- a/packages/backend/src/server/api/endpoints/admin/queue/promote.ts
+++ b/packages/backend/src/server/api/endpoints/admin/queue/promote.ts
@@ -9,14 +9,13 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:queue',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/queue/stats.ts b/packages/backend/src/server/api/endpoints/admin/queue/stats.ts
index 1d92e2bf863..189690b7035 100644
--- a/packages/backend/src/server/api/endpoints/admin/queue/stats.ts
+++ b/packages/backend/src/server/api/endpoints/admin/queue/stats.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import type { DbQueue, DeliverQueue, EndedPollNotificationQueue, InboxQueue, ObjectStorageQueue, SystemQueue, WebhookDeliverQueue } from '@/core/QueueModule.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/relays/add.ts b/packages/backend/src/server/api/endpoints/admin/relays/add.ts
index 53b83560cfc..d55dff7b0c0 100644
--- a/packages/backend/src/server/api/endpoints/admin/relays/add.ts
+++ b/packages/backend/src/server/api/endpoints/admin/relays/add.ts
@@ -10,14 +10,13 @@ import { RelayService } from '@/core/RelayService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:relays',
 
 	errors: {
 		invalidUrl: {
 			message: 'Invalid URL',
 			code: 'INVALID_URL',
diff --git a/packages/backend/src/server/api/endpoints/admin/relays/list.ts b/packages/backend/src/server/api/endpoints/admin/relays/list.ts
index 35c8e054876..61ea287bff2 100644
--- a/packages/backend/src/server/api/endpoints/admin/relays/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/relays/list.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RelayService } from '@/core/RelayService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:relays',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/relays/remove.ts b/packages/backend/src/server/api/endpoints/admin/relays/remove.ts
index fdc53cb7089..8a6dd4e1529 100644
--- a/packages/backend/src/server/api/endpoints/admin/relays/remove.ts
+++ b/packages/backend/src/server/api/endpoints/admin/relays/remove.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RelayService } from '@/core/RelayService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:relays',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/reset-password.ts b/packages/backend/src/server/api/endpoints/admin/reset-password.ts
index 73bbd1f0919..1a402b4a4a0 100644
--- a/packages/backend/src/server/api/endpoints/admin/reset-password.ts
+++ b/packages/backend/src/server/api/endpoints/admin/reset-password.ts
@@ -12,14 +12,13 @@ import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:reset-password',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts b/packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts
index fb26c82a9d2..26c4038b980 100644
--- a/packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts
+++ b/packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts
@@ -13,14 +13,13 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:resolve-abuse-user-report',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/assign.ts b/packages/backend/src/server/api/endpoints/admin/roles/assign.ts
index bbd4cfabbe5..8eb3d2bf59b 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/assign.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/assign.ts
@@ -11,14 +11,13 @@ import { ApiError } from '@/server/api/error.js';
 import { RoleService } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/create.ts b/packages/backend/src/server/api/endpoints/admin/roles/create.ts
index ac6085d9217..de23d2fb116 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/create.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/create.ts
@@ -9,14 +9,13 @@ import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 import { RoleService } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		ref: 'Role',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/delete.ts b/packages/backend/src/server/api/endpoints/admin/roles/delete.ts
index f60d6754a57..9e2968e317e 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/delete.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/delete.ts
@@ -11,14 +11,13 @@ import { ApiError } from '@/server/api/error.js';
 import { RoleService } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/list.ts b/packages/backend/src/server/api/endpoints/admin/roles/list.ts
index 30917ce984c..d3d1a10a693 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/list.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/list.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:roles',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/show.ts b/packages/backend/src/server/api/endpoints/admin/roles/show.ts
index 91e32d95bee..ad4345e5a53 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/show.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/show.ts
@@ -11,14 +11,13 @@ import { ApiError } from '@/server/api/error.js';
 import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/unassign.ts b/packages/backend/src/server/api/endpoints/admin/roles/unassign.ts
index 701fea1ed56..c11265252c0 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/unassign.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/unassign.ts
@@ -11,14 +11,13 @@ import { ApiError } from '@/server/api/error.js';
 import { RoleService } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts b/packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts
index 066fc73234d..203f749a6e7 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts
@@ -9,14 +9,13 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { MetaService } from '@/core/MetaService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/update.ts b/packages/backend/src/server/api/endpoints/admin/roles/update.ts
index 6cfcd8ca4af..74d5aae5d83 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/update.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/update.ts
@@ -12,14 +12,13 @@ import { ApiError } from '@/server/api/error.js';
 import { RoleService } from '@/core/RoleService.js';
 
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/roles/users.ts b/packages/backend/src/server/api/endpoints/admin/roles/users.ts
index 6a0f7f9987b..66f4d9d26b4 100644
--- a/packages/backend/src/server/api/endpoints/admin/roles/users.ts
+++ b/packages/backend/src/server/api/endpoints/admin/roles/users.ts
@@ -14,14 +14,13 @@ import { IdService } from '@/core/IdService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	tags: ['admin', 'role', 'users'],
 
-	kind: 'read:admin',
-
 	requireCredential: false,
 	requireAdmin: true,
+	kind: 'read:admin:roles',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/admin/send-email.ts b/packages/backend/src/server/api/endpoints/admin/send-email.ts
index d22066909ea..d20aee656ca 100644
--- a/packages/backend/src/server/api/endpoints/admin/send-email.ts
+++ b/packages/backend/src/server/api/endpoints/admin/send-email.ts
@@ -8,14 +8,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { EmailService } from '@/core/EmailService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:send-email',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/server-info.ts b/packages/backend/src/server/api/endpoints/admin/server-info.ts
index d3c3bebff66..374712f57d1 100644
--- a/packages/backend/src/server/api/endpoints/admin/server-info.ts
+++ b/packages/backend/src/server/api/endpoints/admin/server-info.ts
@@ -12,15 +12,14 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:server-info',
 
 	tags: ['admin', 'meta'],
 
-	kind: 'read:admin',
-
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
 			machine: {
diff --git a/packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts b/packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts
index c82532ed672..f3601be9bbb 100644
--- a/packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts
+++ b/packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts
@@ -13,12 +13,11 @@ import { ModerationLogEntityService } from '@/core/entities/ModerationLogEntityS
 export const meta = {
 	tags: ['admin'],
 
 	requireCredential: true,
 	requireAdmin: true,
-
-	kind: 'read:admin',
+	kind: 'read:admin:show-moderation-log',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/show-user.ts b/packages/backend/src/server/api/endpoints/admin/show-user.ts
index f1e7b75a329..2b50354cef1 100644
--- a/packages/backend/src/server/api/endpoints/admin/show-user.ts
+++ b/packages/backend/src/server/api/endpoints/admin/show-user.ts
@@ -14,12 +14,11 @@ import { IdService } from '@/core/IdService.js';
 export const meta = {
 	tags: ['admin'],
 
 	requireCredential: true,
 	requireModerator: true,
-
-	kind: 'read:admin',
+	kind: 'read:admin:show-user',
 
 	res: {
 		type: 'object',
 		nullable: false, optional: false,
 	},
diff --git a/packages/backend/src/server/api/endpoints/admin/show-users.ts b/packages/backend/src/server/api/endpoints/admin/show-users.ts
index 50813836871..1d31e5e80f3 100644
--- a/packages/backend/src/server/api/endpoints/admin/show-users.ts
+++ b/packages/backend/src/server/api/endpoints/admin/show-users.ts
@@ -14,12 +14,11 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin'],
 
 	requireCredential: true,
 	requireModerator: true,
-
-	kind: 'read:admin',
+	kind: 'read:admin:show-users',
 
 	res: {
 		type: 'array',
 		nullable: false, optional: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/admin/suspend-user.ts b/packages/backend/src/server/api/endpoints/admin/suspend-user.ts
index 35c3f374811..a26fa81c132 100644
--- a/packages/backend/src/server/api/endpoints/admin/suspend-user.ts
+++ b/packages/backend/src/server/api/endpoints/admin/suspend-user.ts
@@ -17,14 +17,13 @@ import { RoleService } from '@/core/RoleService.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:suspend-user',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts b/packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts
index 23094939371..8b22fad1d47 100644
--- a/packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts
+++ b/packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unset-user-avatar',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts b/packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts
index 468c634e5bc..5ec359c0ef9 100644
--- a/packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts
+++ b/packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unset-user-banner',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts b/packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts
index 8cdd317eae4..9c896f0e647 100644
--- a/packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts
+++ b/packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts
@@ -11,14 +11,13 @@ import { UserSuspendService } from '@/core/UserSuspendService.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unsuspend-user',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/update-meta.ts b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
index 5f9de0523e2..5a215696fb1 100644
--- a/packages/backend/src/server/api/endpoints/admin/update-meta.ts
+++ b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
@@ -10,14 +10,13 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { MetaService } from '@/core/MetaService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:meta',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/admin/update-user-note.ts b/packages/backend/src/server/api/endpoints/admin/update-user-note.ts
index dd0b777373a..e582147e721 100644
--- a/packages/backend/src/server/api/endpoints/admin/update-user-note.ts
+++ b/packages/backend/src/server/api/endpoints/admin/update-user-note.ts
@@ -10,14 +10,13 @@ import { DI } from '@/di-symbols.js';
 import { ModerationLogService } from '@/core/ModerationLogService.js';
 
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:user-note',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/ap/get.ts b/packages/backend/src/server/api/endpoints/ap/get.ts
index a4a7fd20373..e0ef5d413a9 100644
--- a/packages/backend/src/server/api/endpoints/ap/get.ts
+++ b/packages/backend/src/server/api/endpoints/ap/get.ts
@@ -10,10 +10,11 @@ import { ApResolverService } from '@/core/activitypub/ApResolverService.js';
 
 export const meta = {
 	tags: ['federation'],
 
 	requireCredential: true,
+	kind: 'read:federation',
 
 	limit: {
 		duration: ms('1hour'),
 		max: 30,
 	},
diff --git a/packages/backend/src/server/api/endpoints/ap/show.ts b/packages/backend/src/server/api/endpoints/ap/show.ts
index f442fbdd2f4..7e5c7a917cc 100644
--- a/packages/backend/src/server/api/endpoints/ap/show.ts
+++ b/packages/backend/src/server/api/endpoints/ap/show.ts
@@ -23,10 +23,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['federation'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	limit: {
 		duration: ms('1hour'),
 		max: 30,
 	},
diff --git a/packages/backend/src/server/api/endpoints/federation/update-remote-user.ts b/packages/backend/src/server/api/endpoints/federation/update-remote-user.ts
index c0aa882088d..e6198ff6014 100644
--- a/packages/backend/src/server/api/endpoints/federation/update-remote-user.ts
+++ b/packages/backend/src/server/api/endpoints/federation/update-remote-user.ts
@@ -9,11 +9,11 @@ import { ApPersonService } from '@/core/activitypub/models/ApPersonService.js';
 import { GetterService } from '@/server/api/GetterService.js';
 
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: true,
+	requireCredential: false,
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/fetch-external-resources.ts b/packages/backend/src/server/api/endpoints/fetch-external-resources.ts
index 6391a2f5807..cbe579eb6b7 100644
--- a/packages/backend/src/server/api/endpoints/fetch-external-resources.ts
+++ b/packages/backend/src/server/api/endpoints/fetch-external-resources.ts
@@ -12,10 +12,11 @@ import { ApiError } from '../error.js';
 
 export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
+	secure: true,
 
 	limit: {
 		duration: ms('1hour'),
 		max: 50,
 	},
diff --git a/packages/backend/src/server/api/endpoints/i.ts b/packages/backend/src/server/api/endpoints/i.ts
index c0530bf392f..c24e049180e 100644
--- a/packages/backend/src/server/api/endpoints/i.ts
+++ b/packages/backend/src/server/api/endpoints/i.ts
@@ -12,10 +12,11 @@ import { ApiError } from '../error.js';
 
 export const meta = {
 	tags: ['account'],
 
 	requireCredential: true,
+	kind: "read:account",
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		ref: 'MeDetailed',
diff --git a/packages/backend/src/server/api/endpoints/i/claim-achievement.ts b/packages/backend/src/server/api/endpoints/i/claim-achievement.ts
index b24b3438dce..57f680bd7e0 100644
--- a/packages/backend/src/server/api/endpoints/i/claim-achievement.ts
+++ b/packages/backend/src/server/api/endpoints/i/claim-achievement.ts
@@ -8,10 +8,11 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { AchievementService, ACHIEVEMENT_TYPES } from '@/core/AchievementService.js';
 
 export const meta = {
 	requireCredential: true,
 	prohibitMoved: true,
+	kind: 'write:account',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/i/registry/get-all.ts b/packages/backend/src/server/api/endpoints/i/registry/get-all.ts
index bd6e85a074a..79a81cb73fb 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/get-all.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/get-all.ts
@@ -7,10 +7,11 @@ import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'object',
 	},
 } as const;
diff --git a/packages/backend/src/server/api/endpoints/i/registry/get-detail.ts b/packages/backend/src/server/api/endpoints/i/registry/get-detail.ts
index 2352beb1302..d9b26cab2c8 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/get-detail.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/get-detail.ts
@@ -8,10 +8,11 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 
 	errors: {
 		noSuchKey: {
 			message: 'No such key.',
 			code: 'NO_SUCH_KEY',
diff --git a/packages/backend/src/server/api/endpoints/i/registry/get.ts b/packages/backend/src/server/api/endpoints/i/registry/get.ts
index 4155a43e0d3..c373410256f 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/get.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/get.ts
@@ -8,10 +8,11 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 
 	errors: {
 		noSuchKey: {
 			message: 'No such key.',
 			code: 'NO_SUCH_KEY',
diff --git a/packages/backend/src/server/api/endpoints/i/registry/keys-with-type.ts b/packages/backend/src/server/api/endpoints/i/registry/keys-with-type.ts
index b411cdd3d97..a91dcd95438 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/keys-with-type.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/keys-with-type.ts
@@ -7,10 +7,11 @@ import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'object',
 	},
 } as const;
diff --git a/packages/backend/src/server/api/endpoints/i/registry/keys.ts b/packages/backend/src/server/api/endpoints/i/registry/keys.ts
index 04e120d7524..ad203d5203f 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/keys.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/keys.ts
@@ -7,10 +7,11 @@ import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/i/registry/remove.ts b/packages/backend/src/server/api/endpoints/i/registry/remove.ts
index ba8100b5470..9cbe271b91a 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/remove.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/remove.ts
@@ -10,10 +10,11 @@ import { DI } from '@/di-symbols.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 import { ApiError } from '../../../error.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'write:account',
 
 	errors: {
 		noSuchKey: {
 			message: 'No such key.',
 			code: 'NO_SUCH_KEY',
diff --git a/packages/backend/src/server/api/endpoints/i/registry/set.ts b/packages/backend/src/server/api/endpoints/i/registry/set.ts
index 58bb450bce8..c61d5b8727a 100644
--- a/packages/backend/src/server/api/endpoints/i/registry/set.ts
+++ b/packages/backend/src/server/api/endpoints/i/registry/set.ts
@@ -7,10 +7,11 @@ import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { RegistryApiService } from '@/core/RegistryApiService.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'write:account',
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/invite/create.ts b/packages/backend/src/server/api/endpoints/invite/create.ts
index d82fa50e4ff..4f37f2f4bbf 100644
--- a/packages/backend/src/server/api/endpoints/invite/create.ts
+++ b/packages/backend/src/server/api/endpoints/invite/create.ts
@@ -17,10 +17,11 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
 	requireRolePolicy: 'canInvite',
+	kind: 'write:invite-codes',
 
 	errors: {
 		exceededCreateLimit: {
 			message: 'You have exceeded the limit for creating an invitation code.',
 			code: 'EXCEEDED_LIMIT_OF_CREATE_INVITE_CODE',
diff --git a/packages/backend/src/server/api/endpoints/invite/delete.ts b/packages/backend/src/server/api/endpoints/invite/delete.ts
index 3b57775739a..d84430a49f4 100644
--- a/packages/backend/src/server/api/endpoints/invite/delete.ts
+++ b/packages/backend/src/server/api/endpoints/invite/delete.ts
@@ -13,10 +13,11 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
 	requireRolePolicy: 'canInvite',
+	kind: 'write:invite-codes',
 
 	errors: {
 		noSuchCode: {
 			message: 'No such invite code.',
 			code: 'NO_SUCH_INVITE_CODE',
diff --git a/packages/backend/src/server/api/endpoints/invite/limit.ts b/packages/backend/src/server/api/endpoints/invite/limit.ts
index 1f4190c9488..fc3bb9bdc24 100644
--- a/packages/backend/src/server/api/endpoints/invite/limit.ts
+++ b/packages/backend/src/server/api/endpoints/invite/limit.ts
@@ -14,10 +14,11 @@ import { IdService } from '@/core/IdService.js';
 export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
 	requireRolePolicy: 'canInvite',
+	kind: 'read:invite-codes',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/invite/list.ts b/packages/backend/src/server/api/endpoints/invite/list.ts
index 2107516ce49..6734f27e140 100644
--- a/packages/backend/src/server/api/endpoints/invite/list.ts
+++ b/packages/backend/src/server/api/endpoints/invite/list.ts
@@ -13,10 +13,11 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
 	requireRolePolicy: 'canInvite',
+	kind: 'read:invite-codes',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/my/apps.ts b/packages/backend/src/server/api/endpoints/my/apps.ts
index 98c317346f1..1b70b85b07d 100644
--- a/packages/backend/src/server/api/endpoints/my/apps.ts
+++ b/packages/backend/src/server/api/endpoints/my/apps.ts
@@ -11,10 +11,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['account', 'app'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/notes/hybrid-timeline.ts b/packages/backend/src/server/api/endpoints/notes/hybrid-timeline.ts
index effcbaf2ee4..01adfec7d37 100644
--- a/packages/backend/src/server/api/endpoints/notes/hybrid-timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/hybrid-timeline.ts
@@ -23,10 +23,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/notes/mentions.ts b/packages/backend/src/server/api/endpoints/notes/mentions.ts
index 6fab024d17a..2317f8f7b2a 100644
--- a/packages/backend/src/server/api/endpoints/notes/mentions.ts
+++ b/packages/backend/src/server/api/endpoints/notes/mentions.ts
@@ -14,10 +14,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/notes/polls/recommendation.ts b/packages/backend/src/server/api/endpoints/notes/polls/recommendation.ts
index af7ff8bdcdd..90af29a695f 100644
--- a/packages/backend/src/server/api/endpoints/notes/polls/recommendation.ts
+++ b/packages/backend/src/server/api/endpoints/notes/polls/recommendation.ts
@@ -12,10 +12,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/notes/state.ts b/packages/backend/src/server/api/endpoints/notes/state.ts
index b5fd47723cd..20faea566d3 100644
--- a/packages/backend/src/server/api/endpoints/notes/state.ts
+++ b/packages/backend/src/server/api/endpoints/notes/state.ts
@@ -10,10 +10,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/notes/timeline.ts b/packages/backend/src/server/api/endpoints/notes/timeline.ts
index 790bcbe1512..e90d6ec1984 100644
--- a/packages/backend/src/server/api/endpoints/notes/timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/timeline.ts
@@ -20,10 +20,11 @@ import { FanoutTimelineEndpointService } from '@/core/FanoutTimelineEndpointServ
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/notes/translate.ts b/packages/backend/src/server/api/endpoints/notes/translate.ts
index d46bd697958..698c37b616c 100644
--- a/packages/backend/src/server/api/endpoints/notes/translate.ts
+++ b/packages/backend/src/server/api/endpoints/notes/translate.ts
@@ -15,10 +15,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		properties: {
diff --git a/packages/backend/src/server/api/endpoints/notes/user-list-timeline.ts b/packages/backend/src/server/api/endpoints/notes/user-list-timeline.ts
index 10d3a7a6979..71c2b8054e9 100644
--- a/packages/backend/src/server/api/endpoints/notes/user-list-timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/user-list-timeline.ts
@@ -20,10 +20,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['notes', 'lists'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/promo/read.ts b/packages/backend/src/server/api/endpoints/promo/read.ts
index 7d07c92178a..f427939a7a2 100644
--- a/packages/backend/src/server/api/endpoints/promo/read.ts
+++ b/packages/backend/src/server/api/endpoints/promo/read.ts
@@ -13,10 +13,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['notes'],
 
 	requireCredential: true,
+	kind: 'write:account',
 
 	errors: {
 		noSuchNote: {
 			message: 'No such note.',
 			code: 'NO_SUCH_NOTE',
diff --git a/packages/backend/src/server/api/endpoints/roles/list.ts b/packages/backend/src/server/api/endpoints/roles/list.ts
index dc2be8e11d9..d40e937d4e7 100644
--- a/packages/backend/src/server/api/endpoints/roles/list.ts
+++ b/packages/backend/src/server/api/endpoints/roles/list.ts
@@ -11,10 +11,11 @@ import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 
 export const meta = {
 	tags: ['role'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
 		items: {
diff --git a/packages/backend/src/server/api/endpoints/roles/notes.ts b/packages/backend/src/server/api/endpoints/roles/notes.ts
index 7010df22c9a..4ce3fc8908d 100644
--- a/packages/backend/src/server/api/endpoints/roles/notes.ts
+++ b/packages/backend/src/server/api/endpoints/roles/notes.ts
@@ -16,10 +16,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['role', 'notes'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	errors: {
 		noSuchRole: {
 			message: 'No such role.',
 			code: 'NO_SUCH_ROLE',
diff --git a/packages/backend/src/server/api/endpoints/sw/register.ts b/packages/backend/src/server/api/endpoints/sw/register.ts
index 9ab062326df..bb50048d94c 100644
--- a/packages/backend/src/server/api/endpoints/sw/register.ts
+++ b/packages/backend/src/server/api/endpoints/sw/register.ts
@@ -12,10 +12,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['account'],
 
 	requireCredential: true,
+	secure: true,
 
 	description: 'Register to receive push notifications.',
 
 	res: {
 		type: 'object',
diff --git a/packages/backend/src/server/api/endpoints/sw/show-registration.ts b/packages/backend/src/server/api/endpoints/sw/show-registration.ts
index 126299e3f74..15d3df8587d 100644
--- a/packages/backend/src/server/api/endpoints/sw/show-registration.ts
+++ b/packages/backend/src/server/api/endpoints/sw/show-registration.ts
@@ -10,10 +10,11 @@ import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	tags: ['account'],
 
 	requireCredential: true,
+	secure: true,
 
 	description: 'Check push notification registration exists.',
 
 	res: {
 		type: 'object',
diff --git a/packages/backend/src/server/api/endpoints/sw/update-registration.ts b/packages/backend/src/server/api/endpoints/sw/update-registration.ts
index a1a97df0bea..7bf59784a2c 100644
--- a/packages/backend/src/server/api/endpoints/sw/update-registration.ts
+++ b/packages/backend/src/server/api/endpoints/sw/update-registration.ts
@@ -11,10 +11,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['account'],
 
 	requireCredential: true,
+	secure: true,
 
 	description: 'Update push notification registration.',
 
 	res: {
 		type: 'object',
diff --git a/packages/backend/src/server/api/endpoints/users/achievements.ts b/packages/backend/src/server/api/endpoints/users/achievements.ts
index d6ad718dfab..3a584a819a0 100644
--- a/packages/backend/src/server/api/endpoints/users/achievements.ts
+++ b/packages/backend/src/server/api/endpoints/users/achievements.ts
@@ -7,11 +7,11 @@ import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import type { UserProfilesRepository } from '@/models/_.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
-	requireCredential: true,
+	requireCredential: false,
 
 	res: {
 		type: 'array',
 		items: {
 			type: 'object',
@@ -22,11 +22,11 @@ export const meta = {
 				unlockedAt: {
 					type: 'number',
 				},
 			},
 		},
-	}
+	},
 } as const;
 
 export const paramDef = {
 	type: 'object',
 	properties: {
diff --git a/packages/backend/src/server/api/endpoints/users/lists/create-from-public.ts b/packages/backend/src/server/api/endpoints/users/lists/create-from-public.ts
index 4eb37c3e432..fa2e3338b88 100644
--- a/packages/backend/src/server/api/endpoints/users/lists/create-from-public.ts
+++ b/packages/backend/src/server/api/endpoints/users/lists/create-from-public.ts
@@ -16,10 +16,11 @@ import { RoleService } from '@/core/RoleService.js';
 import { UserListService } from '@/core/UserListService.js';
 
 export const meta = {
 	requireCredential: true,
 	prohibitMoved: true,
+	kind: 'write:account',
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
 		ref: 'UserList',
 	},
diff --git a/packages/backend/src/server/api/endpoints/users/lists/favorite.ts b/packages/backend/src/server/api/endpoints/users/lists/favorite.ts
index 2ecf0a12564..864cdc2ee01 100644
--- a/packages/backend/src/server/api/endpoints/users/lists/favorite.ts
+++ b/packages/backend/src/server/api/endpoints/users/lists/favorite.ts
@@ -10,10 +10,11 @@ import { IdService } from '@/core/IdService.js';
 import { ApiError } from '@/server/api/error.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'write:account',
 	errors: {
 		noSuchList: {
 			message: 'No such user list.',
 			code: 'NO_SUCH_USER_LIST',
 			id: '7dbaf3cf-7b42-4b8f-b431-b3919e580dbe',
diff --git a/packages/backend/src/server/api/endpoints/users/lists/unfavorite.ts b/packages/backend/src/server/api/endpoints/users/lists/unfavorite.ts
index 23611ab8c4a..d51d57343e2 100644
--- a/packages/backend/src/server/api/endpoints/users/lists/unfavorite.ts
+++ b/packages/backend/src/server/api/endpoints/users/lists/unfavorite.ts
@@ -9,10 +9,11 @@ import type { UserListFavoritesRepository, UserListsRepository } from '@/models/
 import { ApiError } from '@/server/api/error.js';
 import { DI } from '@/di-symbols.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'write:account',
 	errors: {
 		noSuchList: {
 			message: 'No such user list.',
 			code: 'NO_SUCH_USER_LIST',
 			id: 'baedb33e-76b8-4b0c-86a8-9375c0a7b94b',
diff --git a/packages/backend/src/server/api/endpoints/users/relation.ts b/packages/backend/src/server/api/endpoints/users/relation.ts
index 326042ed3d3..26b61c9fb2c 100644
--- a/packages/backend/src/server/api/endpoints/users/relation.ts
+++ b/packages/backend/src/server/api/endpoints/users/relation.ts
@@ -9,10 +9,11 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js';
 
 export const meta = {
 	tags: ['users'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	description: 'Show the different kinds of relations between the authenticated user and the specified user(s).',
 
 	res: {
 		optional: false, nullable: false,
diff --git a/packages/backend/src/server/api/endpoints/users/report-abuse.ts b/packages/backend/src/server/api/endpoints/users/report-abuse.ts
index 3bcf44cc422..508497ccfb8 100644
--- a/packages/backend/src/server/api/endpoints/users/report-abuse.ts
+++ b/packages/backend/src/server/api/endpoints/users/report-abuse.ts
@@ -18,10 +18,11 @@ import { ApiError } from '../../error.js';
 
 export const meta = {
 	tags: ['users'],
 
 	requireCredential: true,
+	kind: 'write:report-abuse',
 
 	description: 'File a report.',
 
 	errors: {
 		noSuchUser: {
diff --git a/packages/backend/src/server/api/stream/ChannelsService.ts b/packages/backend/src/server/api/stream/ChannelsService.ts
index 8fd106c10cf..3bc5380132a 100644
--- a/packages/backend/src/server/api/stream/ChannelsService.ts
+++ b/packages/backend/src/server/api/stream/ChannelsService.ts
@@ -17,10 +17,11 @@ import { QueueStatsChannelService } from './channels/queue-stats.js';
 import { UserListChannelService } from './channels/user-list.js';
 import { AntennaChannelService } from './channels/antenna.js';
 import { DriveChannelService } from './channels/drive.js';
 import { HashtagChannelService } from './channels/hashtag.js';
 import { RoleTimelineChannelService } from './channels/role-timeline.js';
+import { type MiChannelService } from './channel.js';
 
 @Injectable()
 export class ChannelsService {
 	constructor(
 		private mainChannelService: MainChannelService,
@@ -39,11 +40,11 @@ export class ChannelsService {
 		private adminChannelService: AdminChannelService,
 	) {
 	}
 
 	@bindThis
-	public getChannelService(name: string) {
+	public getChannelService(name: string): MiChannelService<boolean> {
 		switch (name) {
 			case 'main': return this.mainChannelService;
 			case 'homeTimeline': return this.homeTimelineChannelService;
 			case 'localTimeline': return this.localTimelineChannelService;
 			case 'hybridTimeline': return this.hybridTimelineChannelService;
diff --git a/packages/backend/src/server/api/stream/Connection.ts b/packages/backend/src/server/api/stream/Connection.ts
index 4180ccc56a6..a89fbcc5e54 100644
--- a/packages/backend/src/server/api/stream/Connection.ts
+++ b/packages/backend/src/server/api/stream/Connection.ts
@@ -246,10 +246,15 @@ export default class Connection {
 
 		if (channelService.requireCredential && this.user == null) {
 			return;
 		}
 
+		if (this.token && ((channelService.kind && !this.token.permission.some(p => p === channelService.kind))
+			|| (!channelService.kind && channelService.requireCredential))) {
+			return;
+		}
+
 		// 共有可能チャンネルに接続しようとしていて、かつそのチャンネルに既に接続していたら無意味なので無視
 		if (channelService.shouldShare && this.channels.some(c => c.chName === channel)) {
 			return;
 		}
 
diff --git a/packages/backend/src/server/api/stream/channel.ts b/packages/backend/src/server/api/stream/channel.ts
index 46b0709773a..80df3803ebb 100644
--- a/packages/backend/src/server/api/stream/channel.ts
+++ b/packages/backend/src/server/api/stream/channel.ts
@@ -14,10 +14,11 @@ export default abstract class Channel {
 	protected connection: Connection;
 	public id: string;
 	public abstract readonly chName: string;
 	public static readonly shouldShare: boolean;
 	public static readonly requireCredential: boolean;
+	public static readonly kind?: string | null;
 
 	protected get user() {
 		return this.connection.user;
 	}
 
@@ -74,5 +75,12 @@ export default abstract class Channel {
 
 	public dispose?(): void;
 
 	public onMessage?(type: string, body: any): void;
 }
+
+export type MiChannelService<T extends boolean> = {
+	shouldShare: boolean;
+	requireCredential: T;
+	kind: T extends true ? string : string | null | undefined;
+	create: (id: string, connection: Connection) => Channel;
+}
diff --git a/packages/backend/src/server/api/stream/channels/admin.ts b/packages/backend/src/server/api/stream/channels/admin.ts
index bfb36d9cb82..b8f369ce84f 100644
--- a/packages/backend/src/server/api/stream/channels/admin.ts
+++ b/packages/backend/src/server/api/stream/channels/admin.ts
@@ -3,16 +3,17 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
 import { Injectable } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class AdminChannel extends Channel {
 	public readonly chName = 'admin';
 	public static shouldShare = true;
-	public static requireCredential = true;
+	public static requireCredential = true as const;
+	public static kind = 'read:admin:stream';
 
 	@bindThis
 	public async init(params: any) {
 		// Subscribe admin stream
 		this.subscriber.on(`adminStream:${this.user!.id}`, data => {
@@ -20,13 +21,14 @@ class AdminChannel extends Channel {
 		});
 	}
 }
 
 @Injectable()
-export class AdminChannelService {
+export class AdminChannelService implements MiChannelService<true> {
 	public readonly shouldShare = AdminChannel.shouldShare;
 	public readonly requireCredential = AdminChannel.requireCredential;
+	public readonly kind = AdminChannel.kind;
 
 	constructor(
 	) {
 	}
 
diff --git a/packages/backend/src/server/api/stream/channels/antenna.ts b/packages/backend/src/server/api/stream/channels/antenna.ts
index a48e6ba5c6d..200db8eb0eb 100644
--- a/packages/backend/src/server/api/stream/channels/antenna.ts
+++ b/packages/backend/src/server/api/stream/channels/antenna.ts
@@ -6,16 +6,17 @@
 import { Injectable } from '@nestjs/common';
 import { isUserRelated } from '@/misc/is-user-related.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import type { GlobalEvents } from '@/core/GlobalEventService.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class AntennaChannel extends Channel {
 	public readonly chName = 'antenna';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = true as const;
+	public static kind = 'read:account';
 	private antennaId: string;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 
@@ -60,13 +61,14 @@ class AntennaChannel extends Channel {
 		this.subscriber.off(`antennaStream:${this.antennaId}`, this.onEvent);
 	}
 }
 
 @Injectable()
-export class AntennaChannelService {
+export class AntennaChannelService implements MiChannelService<true> {
 	public readonly shouldShare = AntennaChannel.shouldShare;
 	public readonly requireCredential = AntennaChannel.requireCredential;
+	public readonly kind = AntennaChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 	) {
 	}
diff --git a/packages/backend/src/server/api/stream/channels/channel.ts b/packages/backend/src/server/api/stream/channels/channel.ts
index 57034231a37..20275249b81 100644
--- a/packages/backend/src/server/api/stream/channels/channel.ts
+++ b/packages/backend/src/server/api/stream/channels/channel.ts
@@ -6,16 +6,16 @@
 import { Injectable } from '@nestjs/common';
 import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class ChannelChannel extends Channel {
 	public readonly chName = 'channel';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private channelId: string;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 
@@ -63,13 +63,14 @@ class ChannelChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class ChannelChannelService {
+export class ChannelChannelService implements MiChannelService<false> {
 	public readonly shouldShare = ChannelChannel.shouldShare;
 	public readonly requireCredential = ChannelChannel.requireCredential;
+	public readonly kind = ChannelChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 	) {
 	}
diff --git a/packages/backend/src/server/api/stream/channels/drive.ts b/packages/backend/src/server/api/stream/channels/drive.ts
index 83f53c1836e..4bf34a72c97 100644
--- a/packages/backend/src/server/api/stream/channels/drive.ts
+++ b/packages/backend/src/server/api/stream/channels/drive.ts
@@ -3,16 +3,17 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
 import { Injectable } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class DriveChannel extends Channel {
 	public readonly chName = 'drive';
 	public static shouldShare = true;
-	public static requireCredential = true;
+	public static requireCredential = true as const;
+	public static kind = 'read:account';
 
 	@bindThis
 	public async init(params: any) {
 		// Subscribe drive stream
 		this.subscriber.on(`driveStream:${this.user!.id}`, data => {
@@ -20,13 +21,14 @@ class DriveChannel extends Channel {
 		});
 	}
 }
 
 @Injectable()
-export class DriveChannelService {
+export class DriveChannelService implements MiChannelService<true> {
 	public readonly shouldShare = DriveChannel.shouldShare;
 	public readonly requireCredential = DriveChannel.requireCredential;
+	public readonly kind = DriveChannel.kind;
 
 	constructor(
 	) {
 	}
 
diff --git a/packages/backend/src/server/api/stream/channels/global-timeline.ts b/packages/backend/src/server/api/stream/channels/global-timeline.ts
index 553c44071f1..8df13da8a9c 100644
--- a/packages/backend/src/server/api/stream/channels/global-timeline.ts
+++ b/packages/backend/src/server/api/stream/channels/global-timeline.ts
@@ -10,16 +10,16 @@ import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { MetaService } from '@/core/MetaService.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import { RoleService } from '@/core/RoleService.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class GlobalTimelineChannel extends Channel {
 	public readonly chName = 'globalTimeline';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private withRenotes: boolean;
 	private withFiles: boolean;
 
 	constructor(
 		private metaService: MetaService,
@@ -89,13 +89,14 @@ class GlobalTimelineChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class GlobalTimelineChannelService {
+export class GlobalTimelineChannelService implements MiChannelService<false> {
 	public readonly shouldShare = GlobalTimelineChannel.shouldShare;
 	public readonly requireCredential = GlobalTimelineChannel.requireCredential;
+	public readonly kind = GlobalTimelineChannel.kind;
 
 	constructor(
 		private metaService: MetaService,
 		private roleService: RoleService,
 		private noteEntityService: NoteEntityService,
diff --git a/packages/backend/src/server/api/stream/channels/hashtag.ts b/packages/backend/src/server/api/stream/channels/hashtag.ts
index f30b29cfd62..3d4f2fc528f 100644
--- a/packages/backend/src/server/api/stream/channels/hashtag.ts
+++ b/packages/backend/src/server/api/stream/channels/hashtag.ts
@@ -7,16 +7,16 @@ import { Injectable } from '@nestjs/common';
 import { normalizeForSearch } from '@/misc/normalize-for-search.js';
 import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class HashtagChannel extends Channel {
 	public readonly chName = 'hashtag';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private q: string[][];
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 
@@ -68,13 +68,14 @@ class HashtagChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class HashtagChannelService {
+export class HashtagChannelService implements MiChannelService<false> {
 	public readonly shouldShare = HashtagChannel.shouldShare;
 	public readonly requireCredential = HashtagChannel.requireCredential;
+	public readonly kind = HashtagChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 	) {
 	}
diff --git a/packages/backend/src/server/api/stream/channels/home-timeline.ts b/packages/backend/src/server/api/stream/channels/home-timeline.ts
index 80054d0881a..6c9f52ba705 100644
--- a/packages/backend/src/server/api/stream/channels/home-timeline.ts
+++ b/packages/backend/src/server/api/stream/channels/home-timeline.ts
@@ -8,16 +8,17 @@ import { checkWordMute } from '@/misc/check-word-mute.js';
 import { isUserRelated } from '@/misc/is-user-related.js';
 import { isInstanceMuted } from '@/misc/is-instance-muted.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class HomeTimelineChannel extends Channel {
 	public readonly chName = 'homeTimeline';
 	public static shouldShare = false;
-	public static requireCredential = true;
+	public static requireCredential = true as const;
+	public static kind = 'read:account';
 	private withRenotes: boolean;
 	private withFiles: boolean;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
@@ -97,13 +98,14 @@ class HomeTimelineChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class HomeTimelineChannelService {
+export class HomeTimelineChannelService implements MiChannelService<true> {
 	public readonly shouldShare = HomeTimelineChannel.shouldShare;
 	public readonly requireCredential = HomeTimelineChannel.requireCredential;
+	public readonly kind = HomeTimelineChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 	) {
 	}
diff --git a/packages/backend/src/server/api/stream/channels/hybrid-timeline.ts b/packages/backend/src/server/api/stream/channels/hybrid-timeline.ts
index 78645982bff..957d8b6d419 100644
--- a/packages/backend/src/server/api/stream/channels/hybrid-timeline.ts
+++ b/packages/backend/src/server/api/stream/channels/hybrid-timeline.ts
@@ -10,16 +10,17 @@ import { isInstanceMuted } from '@/misc/is-instance-muted.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { MetaService } from '@/core/MetaService.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import { RoleService } from '@/core/RoleService.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class HybridTimelineChannel extends Channel {
 	public readonly chName = 'hybridTimeline';
 	public static shouldShare = false;
-	public static requireCredential = true;
+	public static requireCredential = true as const;
+	public static kind = 'read:account';
 	private withRenotes: boolean;
 	private withReplies: boolean;
 	private withFiles: boolean;
 
 	constructor(
@@ -112,13 +113,14 @@ class HybridTimelineChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class HybridTimelineChannelService {
+export class HybridTimelineChannelService implements MiChannelService<true> {
 	public readonly shouldShare = HybridTimelineChannel.shouldShare;
 	public readonly requireCredential = HybridTimelineChannel.requireCredential;
+	public readonly kind = HybridTimelineChannel.kind;
 
 	constructor(
 		private metaService: MetaService,
 		private roleService: RoleService,
 		private noteEntityService: NoteEntityService,
diff --git a/packages/backend/src/server/api/stream/channels/local-timeline.ts b/packages/backend/src/server/api/stream/channels/local-timeline.ts
index 1388f186ffd..888d268d56e 100644
--- a/packages/backend/src/server/api/stream/channels/local-timeline.ts
+++ b/packages/backend/src/server/api/stream/channels/local-timeline.ts
@@ -9,16 +9,16 @@ import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { MetaService } from '@/core/MetaService.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import { RoleService } from '@/core/RoleService.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class LocalTimelineChannel extends Channel {
 	public readonly chName = 'localTimeline';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private withRenotes: boolean;
 	private withReplies: boolean;
 	private withFiles: boolean;
 
 	constructor(
@@ -88,13 +88,14 @@ class LocalTimelineChannel extends Channel {
 		this.subscriber.off('notesStream', this.onNote);
 	}
 }
 
 @Injectable()
-export class LocalTimelineChannelService {
+export class LocalTimelineChannelService implements MiChannelService<false> {
 	public readonly shouldShare = LocalTimelineChannel.shouldShare;
 	public readonly requireCredential = LocalTimelineChannel.requireCredential;
+	public readonly kind = LocalTimelineChannel.kind;
 
 	constructor(
 		private metaService: MetaService,
 		private roleService: RoleService,
 		private noteEntityService: NoteEntityService,
diff --git a/packages/backend/src/server/api/stream/channels/main.ts b/packages/backend/src/server/api/stream/channels/main.ts
index f969d023378..ab605e3ec5c 100644
--- a/packages/backend/src/server/api/stream/channels/main.ts
+++ b/packages/backend/src/server/api/stream/channels/main.ts
@@ -5,16 +5,17 @@
 
 import { Injectable } from '@nestjs/common';
 import { isInstanceMuted, isUserFromMutedInstance } from '@/misc/is-instance-muted.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class MainChannel extends Channel {
 	public readonly chName = 'main';
 	public static shouldShare = true;
-	public static requireCredential = true;
+	public static requireCredential = true as const;
+	public static kind = 'read:account';
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 
 		id: string,
@@ -61,13 +62,14 @@ class MainChannel extends Channel {
 		});
 	}
 }
 
 @Injectable()
-export class MainChannelService {
+export class MainChannelService implements MiChannelService<true> {
 	public readonly shouldShare = MainChannel.shouldShare;
 	public readonly requireCredential = MainChannel.requireCredential;
+	public readonly kind = MainChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 	) {
 	}
diff --git a/packages/backend/src/server/api/stream/channels/queue-stats.ts b/packages/backend/src/server/api/stream/channels/queue-stats.ts
index f0dc4723035..5ceb2c3bbc4 100644
--- a/packages/backend/src/server/api/stream/channels/queue-stats.ts
+++ b/packages/backend/src/server/api/stream/channels/queue-stats.ts
@@ -4,18 +4,18 @@
  */
 
 import Xev from 'xev';
 import { Injectable } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 const ev = new Xev();
 
 class QueueStatsChannel extends Channel {
 	public readonly chName = 'queueStats';
 	public static shouldShare = true;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 
 	constructor(id: string, connection: Channel['connection']) {
 		super(id, connection);
 		//this.onStats = this.onStats.bind(this);
 		//this.onMessage = this.onMessage.bind(this);
@@ -51,13 +51,14 @@ class QueueStatsChannel extends Channel {
 		ev.removeListener('queueStats', this.onStats);
 	}
 }
 
 @Injectable()
-export class QueueStatsChannelService {
+export class QueueStatsChannelService implements MiChannelService<false> {
 	public readonly shouldShare = QueueStatsChannel.shouldShare;
 	public readonly requireCredential = QueueStatsChannel.requireCredential;
+	public readonly kind = QueueStatsChannel.kind;
 
 	constructor(
 	) {
 	}
 
diff --git a/packages/backend/src/server/api/stream/channels/role-timeline.ts b/packages/backend/src/server/api/stream/channels/role-timeline.ts
index 38d3604cc57..b3bbb77dbf2 100644
--- a/packages/backend/src/server/api/stream/channels/role-timeline.ts
+++ b/packages/backend/src/server/api/stream/channels/role-timeline.ts
@@ -8,16 +8,16 @@ import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { bindThis } from '@/decorators.js';
 import { RoleService } from '@/core/RoleService.js';
 import type { GlobalEvents } from '@/core/GlobalEventService.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class RoleTimelineChannel extends Channel {
 	public readonly chName = 'roleTimeline';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private roleId: string;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 		private roleservice: RoleService,
@@ -65,13 +65,14 @@ class RoleTimelineChannel extends Channel {
 		this.subscriber.off(`roleTimelineStream:${this.roleId}`, this.onEvent);
 	}
 }
 
 @Injectable()
-export class RoleTimelineChannelService {
+export class RoleTimelineChannelService implements MiChannelService<false> {
 	public readonly shouldShare = RoleTimelineChannel.shouldShare;
 	public readonly requireCredential = RoleTimelineChannel.requireCredential;
+	public readonly kind = RoleTimelineChannel.kind;
 
 	constructor(
 		private noteEntityService: NoteEntityService,
 		private roleservice: RoleService,
 	) {
diff --git a/packages/backend/src/server/api/stream/channels/server-stats.ts b/packages/backend/src/server/api/stream/channels/server-stats.ts
index cacae275a84..615b6946ccb 100644
--- a/packages/backend/src/server/api/stream/channels/server-stats.ts
+++ b/packages/backend/src/server/api/stream/channels/server-stats.ts
@@ -4,18 +4,18 @@
  */
 
 import Xev from 'xev';
 import { Injectable } from '@nestjs/common';
 import { bindThis } from '@/decorators.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 const ev = new Xev();
 
 class ServerStatsChannel extends Channel {
 	public readonly chName = 'serverStats';
 	public static shouldShare = true;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 
 	constructor(id: string, connection: Channel['connection']) {
 		super(id, connection);
 		//this.onStats = this.onStats.bind(this);
 		//this.onMessage = this.onMessage.bind(this);
@@ -51,13 +51,14 @@ class ServerStatsChannel extends Channel {
 		ev.removeListener('serverStats', this.onStats);
 	}
 }
 
 @Injectable()
-export class ServerStatsChannelService {
+export class ServerStatsChannelService implements MiChannelService<false> {
 	public readonly shouldShare = ServerStatsChannel.shouldShare;
 	public readonly requireCredential = ServerStatsChannel.requireCredential;
+	public readonly kind = ServerStatsChannel.kind;
 
 	constructor(
 	) {
 	}
 
diff --git a/packages/backend/src/server/api/stream/channels/user-list.ts b/packages/backend/src/server/api/stream/channels/user-list.ts
index fe293e2b4de..909b5a5e031 100644
--- a/packages/backend/src/server/api/stream/channels/user-list.ts
+++ b/packages/backend/src/server/api/stream/channels/user-list.ts
@@ -9,16 +9,16 @@ import { isUserRelated } from '@/misc/is-user-related.js';
 import type { Packed } from '@/misc/json-schema.js';
 import { NoteEntityService } from '@/core/entities/NoteEntityService.js';
 import { DI } from '@/di-symbols.js';
 import { bindThis } from '@/decorators.js';
 import { isInstanceMuted } from '@/misc/is-instance-muted.js';
-import Channel from '../channel.js';
+import Channel, { type MiChannelService } from '../channel.js';
 
 class UserListChannel extends Channel {
 	public readonly chName = 'userList';
 	public static shouldShare = false;
-	public static requireCredential = false;
+	public static requireCredential = false as const;
 	private listId: string;
 	private membershipsMap: Record<string, Pick<MiUserListMembership, 'withReplies'> | undefined> = {};
 	private listUsersClock: NodeJS.Timeout;
 	private withFiles: boolean;
 
@@ -135,13 +135,14 @@ class UserListChannel extends Channel {
 		clearInterval(this.listUsersClock);
 	}
 }
 
 @Injectable()
-export class UserListChannelService {
+export class UserListChannelService implements MiChannelService<false> {
 	public readonly shouldShare = UserListChannel.shouldShare;
 	public readonly requireCredential = UserListChannel.requireCredential;
+	public readonly kind = UserListChannel.kind;
 
 	constructor(
 		@Inject(DI.userListsRepository)
 		private userListsRepository: UserListsRepository,
 
diff --git a/packages/backend/src/server/oauth/OAuth2ProviderService.ts b/packages/backend/src/server/oauth/OAuth2ProviderService.ts
index 4fa7b800e81..5c18f452ce9 100644
--- a/packages/backend/src/server/oauth/OAuth2ProviderService.ts
+++ b/packages/backend/src/server/oauth/OAuth2ProviderService.ts
@@ -15,13 +15,13 @@ import fastifyView from '@fastify/view';
 import pug from 'pug';
 import bodyParser from 'body-parser';
 import fastifyExpress from '@fastify/express';
 import { verifyChallenge } from 'pkce-challenge';
 import { mf2 } from 'microformats-parser';
+import { permissions as kinds } from 'misskey-js';
 import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { HttpRequestService } from '@/core/HttpRequestService.js';
-import { kinds } from '@/misc/api-permissions.js';
 import type { Config } from '@/config.js';
 import { DI } from '@/di-symbols.js';
 import { bindThis } from '@/decorators.js';
 import type { AccessTokensRepository, UsersRepository } from '@/models/_.js';
 import { IdService } from '@/core/IdService.js';
@@ -424,11 +424,11 @@ export class OAuth2ProviderService {
 				if (!clientInfo.redirectUris.includes(redirectURI)) {
 					throw new AuthorizationError('Invalid redirect_uri', 'invalid_request');
 				}
 
 				try {
-					const scopes = [...new Set(scope)].filter(s => kinds.includes(s));
+					const scopes = [...new Set(scope)].filter(s => (<readonly string[]>kinds).includes(s));
 					if (!scopes.length) {
 						throw new AuthorizationError('`scope` parameter has no known scope', 'invalid_scope');
 					}
 					areq.scope = scopes;
 
diff --git a/packages/backend/test/e2e/api.ts b/packages/backend/test/e2e/api.ts
index 15da74931d4..cf24228b839 100644
--- a/packages/backend/test/e2e/api.ts
+++ b/packages/backend/test/e2e/api.ts
@@ -5,11 +5,11 @@
 
 process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
 import { IncomingMessage } from 'http';
-import { signup, api, startServer, successfulApiCall, failedApiCall, uploadFile, waitFire, connectStream, relativeFetch } from '../utils.js';
+import { signup, api, startServer, successfulApiCall, failedApiCall, uploadFile, waitFire, connectStream, relativeFetch, createAppToken } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
 import type * as misskey from 'misskey-js';
 
 describe('API', () => {
 	let app: INestApplicationContext;
@@ -87,10 +87,15 @@ describe('API', () => {
 			assert.strictEqual(res.body.nullableDefault, 'hello');
 		});
 	});
 
 	test('管理者専用のAPIのアクセス制限', async () => {
+		const application = await createAppToken(alice, ['read:account']);
+		const application2 = await createAppToken(alice, ['read:admin:index-stats']);
+		const application3 = await createAppToken(bob, []);
+		const application4 = await createAppToken(bob, ['read:admin:index-stats']);
+
 		// aliceは管理者、APIを使える
 		await successfulApiCall({
 			endpoint: '/admin/get-index-stats',
 			parameters: {},
 			user: alice,
@@ -126,10 +131,46 @@ describe('API', () => {
 		}, {
 			status: 401,
 			code: 'AUTHENTICATION_FAILED',
 			id: 'b0a7f5f8-dc2f-4171-b91f-de88ad238e14',
 		});
+
+		await successfulApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: { token: application2 },
+		});
+
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: { token: application },
+		}, {
+			status: 403,
+			code: 'PERMISSION_DENIED',
+			id: '1370e5b7-d4eb-4566-bb1d-7748ee6a1838',
+		});
+
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: { token: application3 },
+		}, {
+			status: 403,
+			code: 'ROLE_PERMISSION_DENIED',
+			id: 'c3d38592-54c0-429d-be96-5636b0431a61',
+		});
+
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: { token: application4 },
+		}, {
+			status: 403,
+			code: 'ROLE_PERMISSION_DENIED',
+			id: 'c3d38592-54c0-429d-be96-5636b0431a61',
+		});
 	});
 
 	describe('Authentication header', () => {
 		test('一般リクエスト', async () => {
 			await successfulApiCall({
diff --git a/packages/backend/test/e2e/streaming.ts b/packages/backend/test/e2e/streaming.ts
index c4824f50cee..288c54bdbc9 100644
--- a/packages/backend/test/e2e/streaming.ts
+++ b/packages/backend/test/e2e/streaming.ts
@@ -4,12 +4,13 @@
  */
 
 process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
+import { WebSocket } from 'ws';
 import { MiFollowing } from '@/models/Following.js';
-import { signup, api, post, startServer, initTestDb, waitFire } from '../utils.js';
+import { signup, api, post, startServer, initTestDb, waitFire, createAppToken, port } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
 import type * as misskey from 'misskey-js';
 
 describe('Streaming', () => {
 	let app: INestApplicationContext;
@@ -558,10 +559,32 @@ describe('Streaming', () => {
 
 				assert.strictEqual(fired, false);
 			});
 		});
 
+		test('Authentication', async () => {
+			const application = await createAppToken(ayano, []);
+			const application2 = await createAppToken(ayano, ['read:account']);
+			const socket = new WebSocket(`ws://127.0.0.1:${port}/streaming?i=${application}`);
+			const established = await new Promise<boolean>((resolve, reject) => {
+				socket.on('error', () => resolve(false));
+				socket.on('unexpected-response', () => resolve(false));
+				setTimeout(() => resolve(true), 3000);
+			});
+
+			socket.close();
+			assert.strictEqual(established, false);
+
+			const fired = await waitFire(
+				{ token: application2 }, 'hybridTimeline',
+				() => api('notes/create', { text: 'Hello, world!' }, ayano),
+				msg => msg.type === 'note' && msg.body.userId === ayano.id,
+			);
+
+			assert.strictEqual(fired, true);
+		});
+
 		// XXX: QueryFailedError: duplicate key value violates unique constraint "IDX_347fec870eafea7b26c8a73bac"
 		/*
 		describe('Hashtag Timeline', () => {
 			test('指定したハッシュタグの投稿が流れる', () => new Promise<void>(async done => {
 				const ws = await connectStream(chitose, 'hashtag', ({ type, body }) => {
diff --git a/packages/backend/test/utils.ts b/packages/backend/test/utils.ts
index 97118d73c0e..db7629d2c4b 100644
--- a/packages/backend/test/utils.ts
+++ b/packages/backend/test/utils.ts
@@ -4,10 +4,11 @@
  */
 
 import * as assert from 'node:assert';
 import { readFile } from 'node:fs/promises';
 import { isAbsolute, basename } from 'node:path';
+import { randomUUID } from 'node:crypto';
 import { inspect } from 'node:util';
 import WebSocket, { ClientOptions } from 'ws';
 import fetch, { File, RequestInit } from 'node-fetch';
 import { DataSource } from 'typeorm';
 import { JSDOM } from 'jsdom';
@@ -124,10 +125,19 @@ export const post = async (user: UserToken, params?: misskey.Endpoints['notes/cr
 	const res = await api('notes/create', q, user);
 
 	return res.body ? res.body.createdNote : null;
 };
 
+export const createAppToken = async (user: UserToken, permissions: (typeof misskey.permissions)[number][]) => {
+	const res = await api('miauth/gen-token', {
+		session: randomUUID(),
+		permission: permissions,
+	}, user);
+
+	return (res.body as misskey.entities.MiauthGenTokenResponse).token;
+};
+
 // 非公開ノートをAPI越しに見たときのノート NoteEntityService.ts
 export const hiddenNote = (note: any): any => {
 	const temp = {
 		...note,
 		fileIds: [],
diff --git a/packages/frontend/src/components/MkTokenGenerateWindow.vue b/packages/frontend/src/components/MkTokenGenerateWindow.vue
index f5fa86a908f..8e8e26ed5f5 100644
--- a/packages/frontend/src/components/MkTokenGenerateWindow.vue
+++ b/packages/frontend/src/components/MkTokenGenerateWindow.vue
@@ -31,11 +31,11 @@ SPDX-License-Identifier: AGPL-3.0-only
 			<div class="_buttons">
 				<MkButton inline @click="disableAll">{{ i18n.ts.disableAll }}</MkButton>
 				<MkButton inline @click="enableAll">{{ i18n.ts.enableAll }}</MkButton>
 			</div>
 			<div class="_gaps_s">
-				<MkSwitch v-for="kind in (initialPermissions || Misskey.permissions)" :key="kind" v-model="permissions[kind]">{{ i18n.t(`_permissions.${kind}`) }}</MkSwitch>
+				<MkSwitch v-for="kind in Object.keys(permissions)" :key="kind" v-model="permissions[kind]">{{ i18n.t(`_permissions.${kind}`) }}</MkSwitch>
 			</div>
 		</div>
 	</MkSpacer>
 </MkModalWindow>
 </template>
@@ -52,11 +52,11 @@ import { i18n } from '@/i18n.js';
 
 const props = withDefaults(defineProps<{
 	title?: string | null;
 	information?: string | null;
 	initialName?: string | null;
-	initialPermissions?: string[] | null;
+	initialPermissions?: (typeof Misskey.permissions)[number][] | null;
 }>(), {
 	title: null,
 	information: null,
 	initialName: null,
 	initialPermissions: null,
@@ -65,20 +65,21 @@ const props = withDefaults(defineProps<{
 const emit = defineEmits<{
 	(ev: 'closed'): void;
 	(ev: 'done', result: { name: string | null, permissions: string[] }): void;
 }>();
 
+const defaultPermissions = Misskey.permissions.filter(p => !p.startsWith('read:admin') && !p.startsWith('write:admin'));
 const dialog = shallowRef<InstanceType<typeof MkModalWindow>>();
 const name = ref(props.initialName);
-const permissions = ref({});
+const permissions = ref(<Record<(typeof Misskey.permissions)[number], boolean>>{});
 
 if (props.initialPermissions) {
 	for (const kind of props.initialPermissions) {
 		permissions.value[kind] = true;
 	}
 } else {
-	for (const kind of Misskey.permissions) {
+	for (const kind of defaultPermissions) {
 		permissions.value[kind] = false;
 	}
 }
 
 function ok(): void {
diff --git a/packages/misskey-js/src/autogen/apiClientJSDoc.ts b/packages/misskey-js/src/autogen/apiClientJSDoc.ts
index 7f4094845a8..758beaf3a02 100644
--- a/packages/misskey-js/src/autogen/apiClientJSDoc.ts
+++ b/packages/misskey-js/src/autogen/apiClientJSDoc.ts
@@ -1,844 +1,846 @@
 /*
  * version: 2023.12.0
- * generatedAt: 2023-12-25T03:48:32.008Z
+ * generatedAt: 2023-12-26T23:35:09.494Z
  */
 
 import type { SwitchCaseResponseType } from '../api.js';
 import type { Endpoints } from './endpoint.js';
 
 declare module '../api.js' {
   export interface APIClient {
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
      */
     request<E extends 'admin/meta', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
      */
     request<E extends 'admin/abuse-user-reports', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *No* / **Permission**: *write:admin*
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+     * **Credential required**: *No*
      */
     request<E extends 'admin/accounts/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:account*
      */
     request<E extends 'admin/accounts/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:account*
      */
     request<E extends 'admin/accounts/find-by-email', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     request<E extends 'admin/ad/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     request<E extends 'admin/ad/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
      */
     request<E extends 'admin/ad/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     request<E extends 'admin/ad/update', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     request<E extends 'admin/announcements/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     request<E extends 'admin/announcements/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
      */
     request<E extends 'admin/announcements/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     request<E extends 'admin/announcements/update', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     request<E extends 'admin/avatar-decorations/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     request<E extends 'admin/avatar-decorations/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
      */
     request<E extends 'admin/avatar-decorations/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     request<E extends 'admin/avatar-decorations/update', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
      */
     request<E extends 'admin/delete-all-files-of-a-user', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
      */
     request<E extends 'admin/unset-user-avatar', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
      */
     request<E extends 'admin/unset-user-banner', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
      */
     request<E extends 'admin/drive/clean-remote-files', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
      */
     request<E extends 'admin/drive/cleanup', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
      */
     request<E extends 'admin/drive/files', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
      */
     request<E extends 'admin/drive/show-file', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/add-aliases-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/add', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/copy', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/delete-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+     * **Credential required**: *Yes*
      */
     request<E extends 'admin/emoji/import-zip', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     request<E extends 'admin/emoji/list-remote', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     request<E extends 'admin/emoji/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/remove-aliases-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/set-aliases-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/set-category-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/set-license-bulk', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     request<E extends 'admin/emoji/update', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     request<E extends 'admin/federation/delete-all-files', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     request<E extends 'admin/federation/refresh-remote-instance-metadata', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     request<E extends 'admin/federation/remove-all-following', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     request<E extends 'admin/federation/update-instance', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
      */
     request<E extends 'admin/get-index-stats', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
      */
     request<E extends 'admin/get-table-stats', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
      */
     request<E extends 'admin/get-user-ips', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
      */
     request<E extends 'admin/invite/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
      */
     request<E extends 'admin/invite/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
      */
     request<E extends 'admin/promo/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
      */
     request<E extends 'admin/queue/clear', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
      */
     request<E extends 'admin/queue/deliver-delayed', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
      */
     request<E extends 'admin/queue/inbox-delayed', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
      */
     request<E extends 'admin/queue/promote', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     request<E extends 'admin/queue/stats', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
      */
     request<E extends 'admin/relays/add', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
      */
     request<E extends 'admin/relays/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
      */
     request<E extends 'admin/relays/remove', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
      */
     request<E extends 'admin/reset-password', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
      */
     request<E extends 'admin/resolve-abuse-user-report', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
      */
     request<E extends 'admin/send-email', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
      */
     request<E extends 'admin/server-info', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
      */
     request<E extends 'admin/show-moderation-logs', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
      */
     request<E extends 'admin/show-user', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
      */
     request<E extends 'admin/show-users', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
      */
     request<E extends 'admin/suspend-user', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
      */
     request<E extends 'admin/unsuspend-user', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
      */
     request<E extends 'admin/update-meta', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
      */
     request<E extends 'admin/delete-account', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
      */
     request<E extends 'admin/update-user-note', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
      */
     request<E extends 'admin/roles/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
      */
     request<E extends 'admin/roles/show', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/update', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/assign', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/unassign', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     request<E extends 'admin/roles/update-default-policies', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *No* / **Permission**: *read:admin*
+     * **Credential required**: *No* / **Permission**: *read:admin:roles*
      */
     request<E extends 'admin/roles/users', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -922,22 +924,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:federation*
      */
     request<E extends 'ap/get', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'ap/show', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -1727,11 +1729,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *No*
      */
     request<E extends 'federation/update-remote-user', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2035,11 +2037,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2166,11 +2168,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'i/claim-achievement', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2467,66 +2469,66 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i/registry/get-all', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i/registry/get-detail', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i/registry/get', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i/registry/keys-with-type', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'i/registry/keys', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'i/registry/remove', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2545,11 +2547,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'i/registry/set', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2681,44 +2683,44 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
      */
     request<E extends 'invite/create', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
      */
     request<E extends 'invite/delete', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
      */
     request<E extends 'invite/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
      */
     request<E extends 'invite/limit', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2836,11 +2838,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'my/apps', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2957,11 +2959,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/hybrid-timeline', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -2979,22 +2981,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/mentions', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/polls/recommendation', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3100,11 +3102,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/state', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3133,22 +3135,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/timeline', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/translate', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3166,11 +3168,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'notes/user-list-timeline', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3420,22 +3422,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'promo/read', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'roles/list', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3464,11 +3466,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'roles/notes', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3530,10 +3532,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * Check push notification registration exists.
      * 
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     request<E extends 'sw/show-registration', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
@@ -3541,10 +3544,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * Update push notification registration.
      * 
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     request<E extends 'sw/update-registration', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
@@ -3552,10 +3556,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * Register to receive push notifications.
      * 
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     request<E extends 'sw/register', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
@@ -3739,22 +3744,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'users/lists/favorite', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'users/lists/unfavorite', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3772,11 +3777,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     request<E extends 'users/lists/create-from-public', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3860,22 +3865,22 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * Show the different kinds of relations between the authenticated user and the specified user(s).
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     request<E extends 'users/relation', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * File a report.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
      */
     request<E extends 'users/report-abuse', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3915,11 +3920,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
-     * **Credential required**: *Yes*
+     * **Credential required**: *No*
      */
     request<E extends 'users/achievements', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
       credential?: string | null,
@@ -3948,10 +3953,11 @@ declare module '../api.js' {
     ): Promise<SwitchCaseResponseType<E, P>>;
 
     /**
      * No description provided.
      * 
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     request<E extends 'fetch-external-resources', P extends Endpoints[E]['req']>(
       endpoint: E,
       params: P,
diff --git a/packages/misskey-js/src/autogen/endpoint.ts b/packages/misskey-js/src/autogen/endpoint.ts
index 5e057590477..2ed76a22f96 100644
--- a/packages/misskey-js/src/autogen/endpoint.ts
+++ b/packages/misskey-js/src/autogen/endpoint.ts
@@ -1,8 +1,8 @@
 /*
  * version: 2023.12.0
- * generatedAt: 2023-12-25T03:48:32.001Z
+ * generatedAt: 2023-12-26T23:35:09.491Z
  */
 
 import type {
 	EmptyRequest,
 	EmptyResponse,
diff --git a/packages/misskey-js/src/autogen/entities.ts b/packages/misskey-js/src/autogen/entities.ts
index ceb2f242ac4..c857e8e3700 100644
--- a/packages/misskey-js/src/autogen/entities.ts
+++ b/packages/misskey-js/src/autogen/entities.ts
@@ -1,8 +1,8 @@
 /*
  * version: 2023.12.0
- * generatedAt: 2023-12-25T03:48:31.996Z
+ * generatedAt: 2023-12-26T23:35:09.489Z
  */
 
 import { operations } from './types.js';
 
 export type EmptyRequest = Record<string, unknown> | undefined;
diff --git a/packages/misskey-js/src/autogen/models.ts b/packages/misskey-js/src/autogen/models.ts
index a7fde6c1a30..c5b81a6b41c 100644
--- a/packages/misskey-js/src/autogen/models.ts
+++ b/packages/misskey-js/src/autogen/models.ts
@@ -1,8 +1,8 @@
 /*
  * version: 2023.12.0
- * generatedAt: 2023-12-25T03:48:31.993Z
+ * generatedAt: 2023-12-26T23:35:09.485Z
  */
 
 import { components } from './types.js';
 export type Error = components['schemas']['Error'];
 export type UserLite = components['schemas']['UserLite'];
diff --git a/packages/misskey-js/src/autogen/types.ts b/packages/misskey-js/src/autogen/types.ts
index 28fe5654e68..94bb2639809 100644
--- a/packages/misskey-js/src/autogen/types.ts
+++ b/packages/misskey-js/src/autogen/types.ts
@@ -1,11 +1,11 @@
 /* eslint @typescript-eslint/naming-convention: 0 */
 /* eslint @typescript-eslint/no-explicit-any: 0 */
 
 /*
  * version: 2023.12.0
- * generatedAt: 2023-12-25T03:48:31.850Z
+ * generatedAt: 2023-12-26T23:35:09.389Z
  */
 
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -20,686 +20,688 @@ export type paths = {
   '/admin/meta': {
     /**
      * admin/meta
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
      */
     post: operations['admin/meta'];
   };
   '/admin/abuse-user-reports': {
     /**
      * admin/abuse-user-reports
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
      */
     post: operations['admin/abuse-user-reports'];
   };
   '/admin/accounts/create': {
     /**
      * admin/accounts/create
      * @description No description provided.
      *
-     * **Credential required**: *No* / **Permission**: *write:admin*
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+     * **Credential required**: *No*
      */
     post: operations['admin/accounts/create'];
   };
   '/admin/accounts/delete': {
     /**
      * admin/accounts/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:account*
      */
     post: operations['admin/accounts/delete'];
   };
   '/admin/accounts/find-by-email': {
     /**
      * admin/accounts/find-by-email
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:account*
      */
     post: operations['admin/accounts/find-by-email'];
   };
   '/admin/ad/create': {
     /**
      * admin/ad/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     post: operations['admin/ad/create'];
   };
   '/admin/ad/delete': {
     /**
      * admin/ad/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     post: operations['admin/ad/delete'];
   };
   '/admin/ad/list': {
     /**
      * admin/ad/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
      */
     post: operations['admin/ad/list'];
   };
   '/admin/ad/update': {
     /**
      * admin/ad/update
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
      */
     post: operations['admin/ad/update'];
   };
   '/admin/announcements/create': {
     /**
      * admin/announcements/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     post: operations['admin/announcements/create'];
   };
   '/admin/announcements/delete': {
     /**
      * admin/announcements/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     post: operations['admin/announcements/delete'];
   };
   '/admin/announcements/list': {
     /**
      * admin/announcements/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
      */
     post: operations['admin/announcements/list'];
   };
   '/admin/announcements/update': {
     /**
      * admin/announcements/update
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
      */
     post: operations['admin/announcements/update'];
   };
   '/admin/avatar-decorations/create': {
     /**
      * admin/avatar-decorations/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     post: operations['admin/avatar-decorations/create'];
   };
   '/admin/avatar-decorations/delete': {
     /**
      * admin/avatar-decorations/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     post: operations['admin/avatar-decorations/delete'];
   };
   '/admin/avatar-decorations/list': {
     /**
      * admin/avatar-decorations/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
      */
     post: operations['admin/avatar-decorations/list'];
   };
   '/admin/avatar-decorations/update': {
     /**
      * admin/avatar-decorations/update
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
      */
     post: operations['admin/avatar-decorations/update'];
   };
   '/admin/delete-all-files-of-a-user': {
     /**
      * admin/delete-all-files-of-a-user
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
      */
     post: operations['admin/delete-all-files-of-a-user'];
   };
   '/admin/unset-user-avatar': {
     /**
      * admin/unset-user-avatar
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
      */
     post: operations['admin/unset-user-avatar'];
   };
   '/admin/unset-user-banner': {
     /**
      * admin/unset-user-banner
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
      */
     post: operations['admin/unset-user-banner'];
   };
   '/admin/drive/clean-remote-files': {
     /**
      * admin/drive/clean-remote-files
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
      */
     post: operations['admin/drive/clean-remote-files'];
   };
   '/admin/drive/cleanup': {
     /**
      * admin/drive/cleanup
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
      */
     post: operations['admin/drive/cleanup'];
   };
   '/admin/drive/files': {
     /**
      * admin/drive/files
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
      */
     post: operations['admin/drive/files'];
   };
   '/admin/drive/show-file': {
     /**
      * admin/drive/show-file
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
      */
     post: operations['admin/drive/show-file'];
   };
   '/admin/emoji/add-aliases-bulk': {
     /**
      * admin/emoji/add-aliases-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/add-aliases-bulk'];
   };
   '/admin/emoji/add': {
     /**
      * admin/emoji/add
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/add'];
   };
   '/admin/emoji/copy': {
     /**
      * admin/emoji/copy
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/copy'];
   };
   '/admin/emoji/delete-bulk': {
     /**
      * admin/emoji/delete-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/delete-bulk'];
   };
   '/admin/emoji/delete': {
     /**
      * admin/emoji/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/delete'];
   };
   '/admin/emoji/import-zip': {
     /**
      * admin/emoji/import-zip
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+     * **Credential required**: *Yes*
      */
     post: operations['admin/emoji/import-zip'];
   };
   '/admin/emoji/list-remote': {
     /**
      * admin/emoji/list-remote
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     post: operations['admin/emoji/list-remote'];
   };
   '/admin/emoji/list': {
     /**
      * admin/emoji/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     post: operations['admin/emoji/list'];
   };
   '/admin/emoji/remove-aliases-bulk': {
     /**
      * admin/emoji/remove-aliases-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/remove-aliases-bulk'];
   };
   '/admin/emoji/set-aliases-bulk': {
     /**
      * admin/emoji/set-aliases-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/set-aliases-bulk'];
   };
   '/admin/emoji/set-category-bulk': {
     /**
      * admin/emoji/set-category-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/set-category-bulk'];
   };
   '/admin/emoji/set-license-bulk': {
     /**
      * admin/emoji/set-license-bulk
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/set-license-bulk'];
   };
   '/admin/emoji/update': {
     /**
      * admin/emoji/update
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
      */
     post: operations['admin/emoji/update'];
   };
   '/admin/federation/delete-all-files': {
     /**
      * admin/federation/delete-all-files
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     post: operations['admin/federation/delete-all-files'];
   };
   '/admin/federation/refresh-remote-instance-metadata': {
     /**
      * admin/federation/refresh-remote-instance-metadata
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     post: operations['admin/federation/refresh-remote-instance-metadata'];
   };
   '/admin/federation/remove-all-following': {
     /**
      * admin/federation/remove-all-following
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     post: operations['admin/federation/remove-all-following'];
   };
   '/admin/federation/update-instance': {
     /**
      * admin/federation/update-instance
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
      */
     post: operations['admin/federation/update-instance'];
   };
   '/admin/get-index-stats': {
     /**
      * admin/get-index-stats
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
      */
     post: operations['admin/get-index-stats'];
   };
   '/admin/get-table-stats': {
     /**
      * admin/get-table-stats
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
      */
     post: operations['admin/get-table-stats'];
   };
   '/admin/get-user-ips': {
     /**
      * admin/get-user-ips
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
      */
     post: operations['admin/get-user-ips'];
   };
   '/admin/invite/create': {
     /**
      * admin/invite/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
      */
     post: operations['admin/invite/create'];
   };
   '/admin/invite/list': {
     /**
      * admin/invite/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
      */
     post: operations['admin/invite/list'];
   };
   '/admin/promo/create': {
     /**
      * admin/promo/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
      */
     post: operations['admin/promo/create'];
   };
   '/admin/queue/clear': {
     /**
      * admin/queue/clear
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
      */
     post: operations['admin/queue/clear'];
   };
   '/admin/queue/deliver-delayed': {
     /**
      * admin/queue/deliver-delayed
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
      */
     post: operations['admin/queue/deliver-delayed'];
   };
   '/admin/queue/inbox-delayed': {
     /**
      * admin/queue/inbox-delayed
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
      */
     post: operations['admin/queue/inbox-delayed'];
   };
   '/admin/queue/promote': {
     /**
      * admin/queue/promote
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
      */
     post: operations['admin/queue/promote'];
   };
   '/admin/queue/stats': {
     /**
      * admin/queue/stats
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
      */
     post: operations['admin/queue/stats'];
   };
   '/admin/relays/add': {
     /**
      * admin/relays/add
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
      */
     post: operations['admin/relays/add'];
   };
   '/admin/relays/list': {
     /**
      * admin/relays/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
      */
     post: operations['admin/relays/list'];
   };
   '/admin/relays/remove': {
     /**
      * admin/relays/remove
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
      */
     post: operations['admin/relays/remove'];
   };
   '/admin/reset-password': {
     /**
      * admin/reset-password
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
      */
     post: operations['admin/reset-password'];
   };
   '/admin/resolve-abuse-user-report': {
     /**
      * admin/resolve-abuse-user-report
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
      */
     post: operations['admin/resolve-abuse-user-report'];
   };
   '/admin/send-email': {
     /**
      * admin/send-email
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
      */
     post: operations['admin/send-email'];
   };
   '/admin/server-info': {
     /**
      * admin/server-info
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
      */
     post: operations['admin/server-info'];
   };
   '/admin/show-moderation-logs': {
     /**
      * admin/show-moderation-logs
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
      */
     post: operations['admin/show-moderation-logs'];
   };
   '/admin/show-user': {
     /**
      * admin/show-user
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
      */
     post: operations['admin/show-user'];
   };
   '/admin/show-users': {
     /**
      * admin/show-users
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
      */
     post: operations['admin/show-users'];
   };
   '/admin/suspend-user': {
     /**
      * admin/suspend-user
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
      */
     post: operations['admin/suspend-user'];
   };
   '/admin/unsuspend-user': {
     /**
      * admin/unsuspend-user
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
      */
     post: operations['admin/unsuspend-user'];
   };
   '/admin/update-meta': {
     /**
      * admin/update-meta
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
      */
     post: operations['admin/update-meta'];
   };
   '/admin/delete-account': {
     /**
      * admin/delete-account
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
      */
     post: operations['admin/delete-account'];
   };
   '/admin/update-user-note': {
     /**
      * admin/update-user-note
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
      */
     post: operations['admin/update-user-note'];
   };
   '/admin/roles/create': {
     /**
      * admin/roles/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/create'];
   };
   '/admin/roles/delete': {
     /**
      * admin/roles/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/delete'];
   };
   '/admin/roles/list': {
     /**
      * admin/roles/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
      */
     post: operations['admin/roles/list'];
   };
   '/admin/roles/show': {
     /**
      * admin/roles/show
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *read:admin*
+     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
      */
     post: operations['admin/roles/show'];
   };
   '/admin/roles/update': {
     /**
      * admin/roles/update
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/update'];
   };
   '/admin/roles/assign': {
     /**
      * admin/roles/assign
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/assign'];
   };
   '/admin/roles/unassign': {
     /**
      * admin/roles/unassign
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/unassign'];
   };
   '/admin/roles/update-default-policies': {
     /**
      * admin/roles/update-default-policies
      * @description No description provided.
      *
-     * **Credential required**: *Yes* / **Permission**: *write:admin*
+     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
      */
     post: operations['admin/roles/update-default-policies'];
   };
   '/admin/roles/users': {
     /**
      * admin/roles/users
      * @description No description provided.
      *
-     * **Credential required**: *No* / **Permission**: *read:admin*
+     * **Credential required**: *No* / **Permission**: *read:admin:roles*
      */
     post: operations['admin/roles/users'];
   };
   '/announcements': {
     /**
@@ -767,20 +769,20 @@ export type paths = {
   '/ap/get': {
     /**
      * ap/get
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:federation*
      */
     post: operations['ap/get'];
   };
   '/ap/show': {
     /**
      * ap/show
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['ap/show'];
   };
   '/app/create': {
     /**
@@ -1517,11 +1519,11 @@ export type paths = {
   '/federation/update-remote-user': {
     /**
      * federation/update-remote-user
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *No*
      */
     post: operations['federation/update-remote-user'];
   };
   '/federation/users': {
     /**
@@ -1790,11 +1792,11 @@ export type paths = {
   '/i': {
     /**
      * i
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i'];
   };
   '/i/2fa/done': {
     /**
@@ -1899,11 +1901,11 @@ export type paths = {
   '/i/claim-achievement': {
     /**
      * i/claim-achievement
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['i/claim-achievement'];
   };
   '/i/change-password': {
     /**
@@ -2148,56 +2150,56 @@ export type paths = {
   '/i/registry/get-all': {
     /**
      * i/registry/get-all
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i/registry/get-all'];
   };
   '/i/registry/get-detail': {
     /**
      * i/registry/get-detail
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i/registry/get-detail'];
   };
   '/i/registry/get': {
     /**
      * i/registry/get
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i/registry/get'];
   };
   '/i/registry/keys-with-type': {
     /**
      * i/registry/keys-with-type
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i/registry/keys-with-type'];
   };
   '/i/registry/keys': {
     /**
      * i/registry/keys
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['i/registry/keys'];
   };
   '/i/registry/remove': {
     /**
      * i/registry/remove
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['i/registry/remove'];
   };
   '/i/registry/scopes-with-domain': {
     /**
@@ -2212,11 +2214,11 @@ export type paths = {
   '/i/registry/set': {
     /**
      * i/registry/set
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['i/registry/set'];
   };
   '/i/revoke-token': {
     /**
@@ -2324,38 +2326,38 @@ export type paths = {
   '/invite/create': {
     /**
      * invite/create
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
      */
     post: operations['invite/create'];
   };
   '/invite/delete': {
     /**
      * invite/delete
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
      */
     post: operations['invite/delete'];
   };
   '/invite/list': {
     /**
      * invite/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
      */
     post: operations['invite/list'];
   };
   '/invite/limit': {
     /**
      * invite/limit
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
      */
     post: operations['invite/limit'];
   };
   '/meta': {
     /**
@@ -2465,11 +2467,11 @@ export type paths = {
   '/my/apps': {
     /**
      * my/apps
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['my/apps'];
   };
   '/notes': {
     /**
@@ -2571,11 +2573,11 @@ export type paths = {
   '/notes/hybrid-timeline': {
     /**
      * notes/hybrid-timeline
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/hybrid-timeline'];
   };
   '/notes/local-timeline': {
     /**
@@ -2589,20 +2591,20 @@ export type paths = {
   '/notes/mentions': {
     /**
      * notes/mentions
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/mentions'];
   };
   '/notes/polls/recommendation': {
     /**
      * notes/polls/recommendation
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/polls/recommendation'];
   };
   '/notes/polls/vote': {
     /**
@@ -2695,11 +2697,11 @@ export type paths = {
   '/notes/state': {
     /**
      * notes/state
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/state'];
   };
   '/notes/thread-muting/create': {
     /**
@@ -2722,20 +2724,20 @@ export type paths = {
   '/notes/timeline': {
     /**
      * notes/timeline
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/timeline'];
   };
   '/notes/translate': {
     /**
      * notes/translate
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/translate'];
   };
   '/notes/unrenote': {
     /**
@@ -2749,11 +2751,11 @@ export type paths = {
   '/notes/user-list-timeline': {
     /**
      * notes/user-list-timeline
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['notes/user-list-timeline'];
   };
   '/notifications/create': {
     /**
@@ -2957,20 +2959,20 @@ export type paths = {
   '/promo/read': {
     /**
      * promo/read
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['promo/read'];
   };
   '/roles/list': {
     /**
      * roles/list
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['roles/list'];
   };
   '/roles/show': {
     /**
@@ -2993,11 +2995,11 @@ export type paths = {
   '/roles/notes': {
     /**
      * roles/notes
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['roles/notes'];
   };
   '/request-reset-password': {
     /**
@@ -3054,28 +3056,31 @@ export type paths = {
   '/sw/show-registration': {
     /**
      * sw/show-registration
      * @description Check push notification registration exists.
      *
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     post: operations['sw/show-registration'];
   };
   '/sw/update-registration': {
     /**
      * sw/update-registration
      * @description Update push notification registration.
      *
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     post: operations['sw/update-registration'];
   };
   '/sw/register': {
     /**
      * sw/register
      * @description Register to receive push notifications.
      *
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     post: operations['sw/register'];
   };
   '/sw/unregister': {
@@ -3232,20 +3237,20 @@ export type paths = {
   '/users/lists/favorite': {
     /**
      * users/lists/favorite
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['users/lists/favorite'];
   };
   '/users/lists/unfavorite': {
     /**
      * users/lists/unfavorite
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['users/lists/unfavorite'];
   };
   '/users/lists/update': {
     /**
@@ -3259,11 +3264,11 @@ export type paths = {
   '/users/lists/create-from-public': {
     /**
      * users/lists/create-from-public
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:account*
      */
     post: operations['users/lists/create-from-public'];
   };
   '/users/lists/update-membership': {
     /**
@@ -3331,20 +3336,20 @@ export type paths = {
   '/users/relation': {
     /**
      * users/relation
      * @description Show the different kinds of relations between the authenticated user and the specified user(s).
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *read:account*
      */
     post: operations['users/relation'];
   };
   '/users/report-abuse': {
     /**
      * users/report-abuse
      * @description File a report.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
      */
     post: operations['users/report-abuse'];
   };
   '/users/search-by-username-and-host': {
     /**
@@ -3376,11 +3381,11 @@ export type paths = {
   '/users/achievements': {
     /**
      * users/achievements
      * @description No description provided.
      *
-     * **Credential required**: *Yes*
+     * **Credential required**: *No*
      */
     post: operations['users/achievements'];
   };
   '/users/update-memo': {
     /**
@@ -3410,10 +3415,11 @@ export type paths = {
   '/fetch-external-resources': {
     /**
      * fetch-external-resources
      * @description No description provided.
      *
+     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
      * **Credential required**: *Yes*
      */
     post: operations['fetch-external-resources'];
   };
   '/retention': {
@@ -4379,11 +4385,11 @@ export type operations = {
 
   /**
    * admin/meta
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
    */
   'admin/meta': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -4520,11 +4526,11 @@ export type operations = {
   };
   /**
    * admin/abuse-user-reports
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
    */
   'admin/abuse-user-reports': {
     requestBody: {
       content: {
         'application/json': {
@@ -4612,11 +4618,12 @@ export type operations = {
   };
   /**
    * admin/accounts/create
    * @description No description provided.
    *
-   * **Credential required**: *No* / **Permission**: *write:admin*
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+   * **Credential required**: *No*
    */
   'admin/accounts/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -4666,11 +4673,11 @@ export type operations = {
   };
   /**
    * admin/accounts/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:account*
    */
   'admin/accounts/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -4718,11 +4725,11 @@ export type operations = {
   };
   /**
    * admin/accounts/find-by-email
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:account*
    */
   'admin/accounts/find-by-email': {
     requestBody: {
       content: {
         'application/json': {
@@ -4771,11 +4778,11 @@ export type operations = {
   };
   /**
    * admin/ad/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
    */
   'admin/ad/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -4832,11 +4839,11 @@ export type operations = {
   };
   /**
    * admin/ad/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
    */
   'admin/ad/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -4884,11 +4891,11 @@ export type operations = {
   };
   /**
    * admin/ad/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
    */
   'admin/ad/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -4944,11 +4951,11 @@ export type operations = {
   };
   /**
    * admin/ad/update
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
    */
   'admin/ad/update': {
     requestBody: {
       content: {
         'application/json': {
@@ -5005,11 +5012,11 @@ export type operations = {
   };
   /**
    * admin/announcements/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
    */
   'admin/announcements/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -5094,11 +5101,11 @@ export type operations = {
   };
   /**
    * admin/announcements/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
    */
   'admin/announcements/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -5146,11 +5153,11 @@ export type operations = {
   };
   /**
    * admin/announcements/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
    */
   'admin/announcements/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -5220,11 +5227,11 @@ export type operations = {
   };
   /**
    * admin/announcements/update
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
    */
   'admin/announcements/update': {
     requestBody: {
       content: {
         'application/json': {
@@ -5283,11 +5290,11 @@ export type operations = {
   };
   /**
    * admin/avatar-decorations/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
    */
   'admin/avatar-decorations/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -5337,11 +5344,11 @@ export type operations = {
   };
   /**
    * admin/avatar-decorations/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
    */
   'admin/avatar-decorations/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -5389,11 +5396,11 @@ export type operations = {
   };
   /**
    * admin/avatar-decorations/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
    */
   'admin/avatar-decorations/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -5463,11 +5470,11 @@ export type operations = {
   };
   /**
    * admin/avatar-decorations/update
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
    */
   'admin/avatar-decorations/update': {
     requestBody: {
       content: {
         'application/json': {
@@ -5519,11 +5526,11 @@ export type operations = {
   };
   /**
    * admin/delete-all-files-of-a-user
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
    */
   'admin/delete-all-files-of-a-user': {
     requestBody: {
       content: {
         'application/json': {
@@ -5571,11 +5578,11 @@ export type operations = {
   };
   /**
    * admin/unset-user-avatar
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
    */
   'admin/unset-user-avatar': {
     requestBody: {
       content: {
         'application/json': {
@@ -5623,11 +5630,11 @@ export type operations = {
   };
   /**
    * admin/unset-user-banner
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
    */
   'admin/unset-user-banner': {
     requestBody: {
       content: {
         'application/json': {
@@ -5675,11 +5682,11 @@ export type operations = {
   };
   /**
    * admin/drive/clean-remote-files
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
    */
   'admin/drive/clean-remote-files': {
     responses: {
       /** @description OK (without any results) */
       204: {
@@ -5719,11 +5726,11 @@ export type operations = {
   };
   /**
    * admin/drive/cleanup
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
    */
   'admin/drive/cleanup': {
     responses: {
       /** @description OK (without any results) */
       204: {
@@ -5763,11 +5770,11 @@ export type operations = {
   };
   /**
    * admin/drive/files
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
    */
   'admin/drive/files': {
     requestBody: {
       content: {
         'application/json': {
@@ -5834,11 +5841,11 @@ export type operations = {
   };
   /**
    * admin/drive/show-file
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
    */
   'admin/drive/show-file': {
     requestBody: {
       content: {
         'application/json': {
@@ -5938,11 +5945,11 @@ export type operations = {
   };
   /**
    * admin/emoji/add-aliases-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/add-aliases-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -5990,11 +5997,11 @@ export type operations = {
   };
   /**
    * admin/emoji/add
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/add': {
     requestBody: {
       content: {
         'application/json': {
@@ -6050,11 +6057,11 @@ export type operations = {
   };
   /**
    * admin/emoji/copy
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/copy': {
     requestBody: {
       content: {
         'application/json': {
@@ -6107,11 +6114,11 @@ export type operations = {
   };
   /**
    * admin/emoji/delete-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/delete-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -6158,11 +6165,11 @@ export type operations = {
   };
   /**
    * admin/emoji/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -6210,11 +6217,12 @@ export type operations = {
   };
   /**
    * admin/emoji/import-zip
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
+   * **Credential required**: *Yes*
    */
   'admin/emoji/import-zip': {
     requestBody: {
       content: {
         'application/json': {
@@ -6262,11 +6270,11 @@ export type operations = {
   };
   /**
    * admin/emoji/list-remote
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
    */
   'admin/emoji/list-remote': {
     requestBody: {
       content: {
         'application/json': {
@@ -6336,11 +6344,11 @@ export type operations = {
   };
   /**
    * admin/emoji/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
    */
   'admin/emoji/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -6405,11 +6413,11 @@ export type operations = {
   };
   /**
    * admin/emoji/remove-aliases-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/remove-aliases-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -6457,11 +6465,11 @@ export type operations = {
   };
   /**
    * admin/emoji/set-aliases-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/set-aliases-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -6509,11 +6517,11 @@ export type operations = {
   };
   /**
    * admin/emoji/set-category-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/set-category-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -6562,11 +6570,11 @@ export type operations = {
   };
   /**
    * admin/emoji/set-license-bulk
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/set-license-bulk': {
     requestBody: {
       content: {
         'application/json': {
@@ -6615,11 +6623,11 @@ export type operations = {
   };
   /**
    * admin/emoji/update
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
    */
   'admin/emoji/update': {
     requestBody: {
       content: {
         'application/json': {
@@ -6677,11 +6685,11 @@ export type operations = {
   };
   /**
    * admin/federation/delete-all-files
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
    */
   'admin/federation/delete-all-files': {
     requestBody: {
       content: {
         'application/json': {
@@ -6728,11 +6736,11 @@ export type operations = {
   };
   /**
    * admin/federation/refresh-remote-instance-metadata
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
    */
   'admin/federation/refresh-remote-instance-metadata': {
     requestBody: {
       content: {
         'application/json': {
@@ -6779,11 +6787,11 @@ export type operations = {
   };
   /**
    * admin/federation/remove-all-following
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
    */
   'admin/federation/remove-all-following': {
     requestBody: {
       content: {
         'application/json': {
@@ -6830,11 +6838,11 @@ export type operations = {
   };
   /**
    * admin/federation/update-instance
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
    */
   'admin/federation/update-instance': {
     requestBody: {
       content: {
         'application/json': {
@@ -6882,11 +6890,11 @@ export type operations = {
   };
   /**
    * admin/get-index-stats
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
    */
   'admin/get-index-stats': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -6931,11 +6939,11 @@ export type operations = {
   };
   /**
    * admin/get-table-stats
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
    */
   'admin/get-table-stats': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -6977,11 +6985,11 @@ export type operations = {
   };
   /**
    * admin/get-user-ips
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
    */
   'admin/get-user-ips': {
     requestBody: {
       content: {
         'application/json': {
@@ -7035,11 +7043,11 @@ export type operations = {
   };
   /**
    * admin/invite/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
    */
   'admin/invite/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -7090,11 +7098,11 @@ export type operations = {
   };
   /**
    * admin/invite/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
    */
   'admin/invite/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -7153,11 +7161,11 @@ export type operations = {
   };
   /**
    * admin/promo/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
    */
   'admin/promo/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -7206,11 +7214,11 @@ export type operations = {
   };
   /**
    * admin/queue/clear
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
    */
   'admin/queue/clear': {
     responses: {
       /** @description OK (without any results) */
       204: {
@@ -7250,11 +7258,11 @@ export type operations = {
   };
   /**
    * admin/queue/deliver-delayed
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
    */
   'admin/queue/deliver-delayed': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -7296,11 +7304,11 @@ export type operations = {
   };
   /**
    * admin/queue/inbox-delayed
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
    */
   'admin/queue/inbox-delayed': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -7342,11 +7350,11 @@ export type operations = {
   };
   /**
    * admin/queue/promote
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
    */
   'admin/queue/promote': {
     requestBody: {
       content: {
         'application/json': {
@@ -7394,11 +7402,11 @@ export type operations = {
   };
   /**
    * admin/queue/stats
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
    */
   'admin/queue/stats': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -7445,11 +7453,11 @@ export type operations = {
   };
   /**
    * admin/relays/add
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
    */
   'admin/relays/add': {
     requestBody: {
       content: {
         'application/json': {
@@ -7508,11 +7516,11 @@ export type operations = {
   };
   /**
    * admin/relays/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
    */
   'admin/relays/list': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -7564,11 +7572,11 @@ export type operations = {
   };
   /**
    * admin/relays/remove
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
    */
   'admin/relays/remove': {
     requestBody: {
       content: {
         'application/json': {
@@ -7615,11 +7623,11 @@ export type operations = {
   };
   /**
    * admin/reset-password
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
    */
   'admin/reset-password': {
     requestBody: {
       content: {
         'application/json': {
@@ -7671,11 +7679,11 @@ export type operations = {
   };
   /**
    * admin/resolve-abuse-user-report
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
    */
   'admin/resolve-abuse-user-report': {
     requestBody: {
       content: {
         'application/json': {
@@ -7725,11 +7733,11 @@ export type operations = {
   };
   /**
    * admin/send-email
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
    */
   'admin/send-email': {
     requestBody: {
       content: {
         'application/json': {
@@ -7778,11 +7786,11 @@ export type operations = {
   };
   /**
    * admin/server-info
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
    */
   'admin/server-info': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -7848,11 +7856,11 @@ export type operations = {
   };
   /**
    * admin/show-moderation-logs
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
    */
   'admin/show-moderation-logs': {
     requestBody: {
       content: {
         'application/json': {
@@ -7919,11 +7927,11 @@ export type operations = {
   };
   /**
    * admin/show-user
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
    */
   'admin/show-user': {
     requestBody: {
       content: {
         'application/json': {
@@ -7973,11 +7981,11 @@ export type operations = {
   };
   /**
    * admin/show-users
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
    */
   'admin/show-users': {
     requestBody: {
       content: {
         'application/json': {
@@ -8048,11 +8056,11 @@ export type operations = {
   };
   /**
    * admin/suspend-user
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
    */
   'admin/suspend-user': {
     requestBody: {
       content: {
         'application/json': {
@@ -8100,11 +8108,11 @@ export type operations = {
   };
   /**
    * admin/unsuspend-user
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
    */
   'admin/unsuspend-user': {
     requestBody: {
       content: {
         'application/json': {
@@ -8152,11 +8160,11 @@ export type operations = {
   };
   /**
    * admin/update-meta
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
    */
   'admin/update-meta': {
     requestBody: {
       content: {
         'application/json': {
@@ -8297,11 +8305,11 @@ export type operations = {
   };
   /**
    * admin/delete-account
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
    */
   'admin/delete-account': {
     requestBody: {
       content: {
         'application/json': {
@@ -8351,11 +8359,11 @@ export type operations = {
   };
   /**
    * admin/update-user-note
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
    */
   'admin/update-user-note': {
     requestBody: {
       content: {
         'application/json': {
@@ -8404,11 +8412,11 @@ export type operations = {
   };
   /**
    * admin/roles/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/create': {
     requestBody: {
       content: {
         'application/json': {
@@ -8472,11 +8480,11 @@ export type operations = {
   };
   /**
    * admin/roles/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -8524,11 +8532,11 @@ export type operations = {
   };
   /**
    * admin/roles/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
    */
   'admin/roles/list': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -8570,11 +8578,11 @@ export type operations = {
   };
   /**
    * admin/roles/show
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *read:admin*
+   * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
    */
   'admin/roles/show': {
     requestBody: {
       content: {
         'application/json': {
@@ -8624,11 +8632,11 @@ export type operations = {
   };
   /**
    * admin/roles/update
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/update': {
     requestBody: {
       content: {
         'application/json': {
@@ -8691,11 +8699,11 @@ export type operations = {
   };
   /**
    * admin/roles/assign
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/assign': {
     requestBody: {
       content: {
         'application/json': {
@@ -8746,11 +8754,11 @@ export type operations = {
   };
   /**
    * admin/roles/unassign
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/unassign': {
     requestBody: {
       content: {
         'application/json': {
@@ -8800,11 +8808,11 @@ export type operations = {
   };
   /**
    * admin/roles/update-default-policies
    * @description No description provided.
    *
-   * **Credential required**: *Yes* / **Permission**: *write:admin*
+   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
    */
   'admin/roles/update-default-policies': {
     requestBody: {
       content: {
         'application/json': {
@@ -8851,11 +8859,11 @@ export type operations = {
   };
   /**
    * admin/roles/users
    * @description No description provided.
    *
-   * **Credential required**: *No* / **Permission**: *read:admin*
+   * **Credential required**: *No* / **Permission**: *read:admin:roles*
    */
   'admin/roles/users': {
     requestBody: {
       content: {
         'application/json': {
@@ -9325,11 +9333,11 @@ export type operations = {
   };
   /**
    * ap/get
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:federation*
    */
   'ap/get': {
     requestBody: {
       content: {
         'application/json': {
@@ -9384,11 +9392,11 @@ export type operations = {
   };
   /**
    * ap/show
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'ap/show': {
     requestBody: {
       content: {
         'application/json': {
@@ -13613,11 +13621,11 @@ export type operations = {
   };
   /**
    * federation/update-remote-user
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *No*
    */
   'federation/update-remote-user': {
     requestBody: {
       content: {
         'application/json': {
@@ -15198,11 +15206,11 @@ export type operations = {
   };
   /**
    * i
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   i: {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -15851,11 +15859,11 @@ export type operations = {
   };
   /**
    * i/claim-achievement
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'i/claim-achievement': {
     requestBody: {
       content: {
         'application/json': {
@@ -17309,11 +17317,11 @@ export type operations = {
   };
   /**
    * i/registry/get-all
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'i/registry/get-all': {
     requestBody: {
       content: {
         'application/json': {
@@ -17364,11 +17372,11 @@ export type operations = {
   };
   /**
    * i/registry/get-detail
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'i/registry/get-detail': {
     requestBody: {
       content: {
         'application/json': {
@@ -17420,11 +17428,11 @@ export type operations = {
   };
   /**
    * i/registry/get
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'i/registry/get': {
     requestBody: {
       content: {
         'application/json': {
@@ -17476,11 +17484,11 @@ export type operations = {
   };
   /**
    * i/registry/keys-with-type
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'i/registry/keys-with-type': {
     requestBody: {
       content: {
         'application/json': {
@@ -17531,11 +17539,11 @@ export type operations = {
   };
   /**
    * i/registry/keys
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'i/registry/keys': {
     requestBody: {
       content: {
         'application/json': {
@@ -17584,11 +17592,11 @@ export type operations = {
   };
   /**
    * i/registry/remove
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'i/registry/remove': {
     requestBody: {
       content: {
         'application/json': {
@@ -17688,11 +17696,11 @@ export type operations = {
   };
   /**
    * i/registry/set
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'i/registry/set': {
     requestBody: {
       content: {
         'application/json': {
@@ -18444,11 +18452,11 @@ export type operations = {
   };
   /**
    * invite/create
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
    */
   'invite/create': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -18490,11 +18498,11 @@ export type operations = {
   };
   /**
    * invite/delete
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
    */
   'invite/delete': {
     requestBody: {
       content: {
         'application/json': {
@@ -18542,11 +18550,11 @@ export type operations = {
   };
   /**
    * invite/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
    */
   'invite/list': {
     requestBody: {
       content: {
         'application/json': {
@@ -18600,11 +18608,11 @@ export type operations = {
   };
   /**
    * invite/limit
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
    */
   'invite/limit': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -19280,11 +19288,11 @@ export type operations = {
   };
   /**
    * my/apps
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'my/apps': {
     requestBody: {
       content: {
         'application/json': {
@@ -19957,11 +19965,11 @@ export type operations = {
   };
   /**
    * notes/hybrid-timeline
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/hybrid-timeline': {
     requestBody: {
       content: {
         'application/json': {
@@ -20099,11 +20107,11 @@ export type operations = {
   };
   /**
    * notes/mentions
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/mentions': {
     requestBody: {
       content: {
         'application/json': {
@@ -20160,11 +20168,11 @@ export type operations = {
   };
   /**
    * notes/polls/recommendation
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/polls/recommendation': {
     requestBody: {
       content: {
         'application/json': {
@@ -20760,11 +20768,11 @@ export type operations = {
   };
   /**
    * notes/state
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/state': {
     requestBody: {
       content: {
         'application/json': {
@@ -20927,11 +20935,11 @@ export type operations = {
   };
   /**
    * notes/timeline
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/timeline': {
     requestBody: {
       content: {
         'application/json': {
@@ -20999,11 +21007,11 @@ export type operations = {
   };
   /**
    * notes/translate
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/translate': {
     requestBody: {
       content: {
         'application/json': {
@@ -21115,11 +21123,11 @@ export type operations = {
   };
   /**
    * notes/user-list-timeline
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'notes/user-list-timeline': {
     requestBody: {
       content: {
         'application/json': {
@@ -22407,11 +22415,11 @@ export type operations = {
   };
   /**
    * promo/read
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'promo/read': {
     requestBody: {
       content: {
         'application/json': {
@@ -22459,11 +22467,11 @@ export type operations = {
   };
   /**
    * roles/list
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'roles/list': {
     responses: {
       /** @description OK (with results) */
       200: {
@@ -22623,11 +22631,11 @@ export type operations = {
   };
   /**
    * roles/notes
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'roles/notes': {
     requestBody: {
       content: {
         'application/json': {
@@ -22952,10 +22960,11 @@ export type operations = {
   };
   /**
    * sw/show-registration
    * @description Check push notification registration exists.
    *
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
    * **Credential required**: *Yes*
    */
   'sw/show-registration': {
     requestBody: {
       content: {
@@ -23013,10 +23022,11 @@ export type operations = {
   };
   /**
    * sw/update-registration
    * @description Update push notification registration.
    *
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
    * **Credential required**: *Yes*
    */
   'sw/update-registration': {
     requestBody: {
       content: {
@@ -23071,10 +23081,11 @@ export type operations = {
   };
   /**
    * sw/register
    * @description Register to receive push notifications.
    *
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
    * **Credential required**: *Yes*
    */
   'sw/register': {
     requestBody: {
       content: {
@@ -24075,11 +24086,11 @@ export type operations = {
   };
   /**
    * users/lists/favorite
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'users/lists/favorite': {
     requestBody: {
       content: {
         'application/json': {
@@ -24127,11 +24138,11 @@ export type operations = {
   };
   /**
    * users/lists/unfavorite
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'users/lists/unfavorite': {
     requestBody: {
       content: {
         'application/json': {
@@ -24235,11 +24246,11 @@ export type operations = {
   };
   /**
    * users/lists/create-from-public
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:account*
    */
   'users/lists/create-from-public': {
     requestBody: {
       content: {
         'application/json': {
@@ -24726,11 +24737,11 @@ export type operations = {
   };
   /**
    * users/relation
    * @description Show the different kinds of relations between the authenticated user and the specified user(s).
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *read:account*
    */
   'users/relation': {
     requestBody: {
       content: {
         'application/json': {
@@ -24801,11 +24812,11 @@ export type operations = {
   };
   /**
    * users/report-abuse
    * @description File a report.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
    */
   'users/report-abuse': {
     requestBody: {
       content: {
         'application/json': {
@@ -25034,11 +25045,11 @@ export type operations = {
   };
   /**
    * users/achievements
    * @description No description provided.
    *
-   * **Credential required**: *Yes*
+   * **Credential required**: *No*
    */
   'users/achievements': {
     requestBody: {
       content: {
         'application/json': {
@@ -25200,10 +25211,11 @@ export type operations = {
   };
   /**
    * fetch-external-resources
    * @description No description provided.
    *
+   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
    * **Credential required**: *Yes*
    */
   'fetch-external-resources': {
     requestBody: {
       content: {
diff --git a/packages/misskey-js/src/consts.ts b/packages/misskey-js/src/consts.ts
index e769bb9e6db..0e446c12159 100644
--- a/packages/misskey-js/src/consts.ts
+++ b/packages/misskey-js/src/consts.ts
@@ -43,11 +43,59 @@ export const permissions = [
 	'write:gallery-likes',
 	'read:flash',
 	'write:flash',
 	'read:flash-likes',
 	'write:flash-likes',
-];
+	'read:admin:abuse-user-reports',
+	'write:admin:delete-account',
+	'write:admin:delete-all-files-of-a-user',
+	'read:admin:index-stats',
+	'read:admin:table-stats',
+	'read:admin:user-ips',
+	'read:admin:meta',
+	'write:admin:reset-password',
+	'write:admin:resolve-abuse-user-report',
+	'write:admin:send-email',
+	'read:admin:server-info',
+	'read:admin:show-moderation-log',
+	'read:admin:show-user',
+	'read:admin:show-users',
+	'write:admin:suspend-user',
+	'write:admin:unset-user-avatar',
+	'write:admin:unset-user-banner',
+	'write:admin:unsuspend-user',
+	'write:admin:meta',
+	'write:admin:user-note',
+	'write:admin:roles',
+	'read:admin:roles',
+	'write:admin:relays',
+	'read:admin:relays',
+	'write:admin:invite-codes',
+	'read:admin:invite-codes',
+	'write:admin:announcements',
+	'read:admin:announcements',
+	'write:admin:avatar-decorations',
+	'read:admin:avatar-decorations',
+	'write:admin:federation',
+	'write:admin:account',
+	'read:admin:account',
+	'write:admin:emoji',
+	'read:admin:emoji',
+	'write:admin:queue',
+	'read:admin:queue',
+	'write:admin:promo',
+	'write:admin:drive',
+	'read:admin:drive',
+	'write:admin:ad',
+	'read:admin:ad',
+	'write:invite-codes',
+	'read:invite-codes',
+	'write:clip-favorite',
+	'read:clip-favorite',
+	'read:federation',
+	'write:report-abuse',
+] as const;
 
 export const moderationLogTypes = [
 	'updateServerSettings',
 	'suspend',
 	'unsuspend',

Vulnerable code: - Fix: 管理者用APIのアクセス権限が適切に設定されていない問題を修正
/*
 * SPDX-FileCopyrightText: syuilo and other misskey contributors
 * SPDX-License-Identifier: AGPL-3.0-only
 */

export const kinds = [
	'read:account',
	'write:account',
	'read:blocks',
	'write:blocks',
	'read:drive',
	'write:drive',
	'read:favorites',
	'write:favorites',
	'read:following',
	'write:following',
	'read:messaging',
	'write:messaging',
	'read:mutes',
	'write:mutes',
	'write:notes',
	'read:notifications',
	'write:notifications',
	'read:reactions',
	'write:reactions',
	'write:votes',
	'read:pages',
	'write:pages',
	'write:page-likes',
	'read:page-likes',
	'read:user-groups',
	'write:user-groups',
	'read:channels',
	'write:channels',
	'read:gallery',
	'write:gallery',
	'read:gallery-likes',
	'write:gallery-likes',
];
// IF YOU ADD KINDS(PERMISSIONS), YOU MUST ADD TRANSLATIONS (under _permissions).
		if (token && ep.meta.kind && !token.permission.some(p => p === ep.meta.kind)) {
export interface IEndpointMeta {
	kind: 'read:admin',

	kind: 'write:admin',
	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',
	kind: 'read:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',


	kind: 'read:admin',

	kind: 'read:admin',
	kind: 'read:admin',

	}
	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'read:admin',

	kind: 'write:admin',

	kind: 'read:admin',


	kind: 'read:admin',

	kind: 'read:admin',

	kind: 'read:admin',
	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	kind: 'write:admin',

	requireCredential: true,
	requireCredential: true,
	}
	public getChannelService(name: string) {
import Channel from '../channel.js';
	public static requireCredential = true;
export class AdminChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class AntennaChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class ChannelChannelService {
import Channel from '../channel.js';
	public static requireCredential = true;
export class DriveChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class GlobalTimelineChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class HashtagChannelService {
import Channel from '../channel.js';
	public static requireCredential = true;
export class HomeTimelineChannelService {
import Channel from '../channel.js';
	public static requireCredential = true;
export class HybridTimelineChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class LocalTimelineChannelService {
import Channel from '../channel.js';
	public static requireCredential = true;
export class MainChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class QueueStatsChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class RoleTimelineChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class ServerStatsChannelService {
import Channel from '../channel.js';
	public static requireCredential = false;
export class UserListChannelService {
import { kinds } from '@/misc/api-permissions.js';
					const scopes = [...new Set(scope)].filter(s => kinds.includes(s));
import { signup, api, startServer, successfulApiCall, failedApiCall, uploadFile, waitFire, connectStream, relativeFetch } from '../utils.js';
import { signup, api, post, startServer, initTestDb, waitFire } from '../utils.js';
				<MkSwitch v-for="kind in (initialPermissions || Misskey.permissions)" :key="kind" v-model="permissions[kind]">{{ i18n.t(`_permissions.${kind}`) }}</MkSwitch>
	initialPermissions?: string[] | null;
const permissions = ref({});
	for (const kind of Misskey.permissions) {
 * generatedAt: 2023-12-25T03:48:32.008Z
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *No* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *No* / **Permission**: *read:admin*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
 * generatedAt: 2023-12-25T03:48:32.001Z
 * generatedAt: 2023-12-25T03:48:31.996Z
 * generatedAt: 2023-12-25T03:48:31.993Z
 * generatedAt: 2023-12-25T03:48:31.850Z
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *No* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *read:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *Yes* / **Permission**: *write:admin*
     * **Credential required**: *No* / **Permission**: *read:admin*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
     * **Credential required**: *Yes*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *No* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *read:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *Yes* / **Permission**: *write:admin*
   * **Credential required**: *No* / **Permission**: *read:admin*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
   * **Credential required**: *Yes*
];
Fixed code:         "read:admin:abuse-user-reports": string;
        "write:admin:delete-account": string;
        "write:admin:delete-all-files-of-a-user": string;
        "read:admin:index-stats": string;
        "read:admin:table-stats": string;
        "read:admin:user-ips": string;
        "read:admin:meta": string;
        "write:admin:reset-password": string;
        "write:admin:resolve-abuse-user-report": string;
        "write:admin:send-email": string;
        "read:admin:server-info": string;
        "read:admin:show-moderation-log": string;
        "read:admin:show-user": string;
        "read:admin:show-users": string;
        "write:admin:suspend-user": string;
        "write:admin:unset-user-avatar": string;
        "write:admin:unset-user-banner": string;
        "write:admin:unsuspend-user": string;
        "write:admin:meta": string;
        "write:admin:user-note": string;
        "write:admin:roles": string;
        "read:admin:roles": string;
        "write:admin:relays": string;
        "read:admin:relays": string;
        "write:admin:invite-codes": string;
        "read:admin:invite-codes": string;
        "write:admin:announcements": string;
        "read:admin:announcements": string;
        "write:admin:avatar-decorations": string;
        "read:admin:avatar-decorations": string;
        "write:admin:federation": string;
        "write:admin:account": string;
        "read:admin:account": string;
        "write:admin:emoji": string;
        "read:admin:emoji": string;
        "write:admin:queue": string;
        "read:admin:queue": string;
        "write:admin:promo": string;
        "write:admin:drive": string;
        "read:admin:drive": string;
        "read:admin:stream": string;
        "write:admin:ad": string;
        "read:admin:ad": string;
        "write:invite-codes": string;
        "read:invite-codes": string;
        "write:clip-favorite": string;
        "read:clip-favorite": string;
        "read:federation": string;
        "write:report-abuse": string;
  "read:admin:abuse-user-reports": "ユーザーからの通報を見る"
  "write:admin:delete-account": "ユーザーアカウントを削除する"
  "write:admin:delete-all-files-of-a-user": "ユーザーのすべてのファイルを削除する"
  "read:admin:index-stats": "データベースインデックスに関する情報を見る"
  "read:admin:table-stats": "データベーステーブルに関する情報を見る"
  "read:admin:user-ips": "ユーザーのIPアドレスを見る"
  "read:admin:meta": "インスタンスのメタデータを見る"
  "write:admin:reset-password": "ユーザーのパスワードをリセットする"
  "write:admin:resolve-abuse-user-report": "ユーザーからの通報を解決する"
  "write:admin:send-email": "メールを送る"
  "read:admin:server-info": "サーバーの情報を見る"
  "read:admin:show-moderation-log": "モデレーションログを見る"
  "read:admin:show-user": "ユーザーのプライベートな情報を見る"
  "read:admin:show-users": "ユーザーのプライベートな情報を見る"
  "write:admin:suspend-user": "ユーザーを凍結する"
  "write:admin:unset-user-avatar": "ユーザーのアバターを削除する"
  "write:admin:unset-user-banner": "ユーザーのバーナーを削除する"
  "write:admin:unsuspend-user": "ユーザーの凍結を解除する"
  "write:admin:meta": "インスタンスのメタデータを操作する"
  "write:admin:user-note": "モデレーションノートを操作する"
  "write:admin:roles": "ロールを操作する"
  "read:admin:roles": "ロールを見る"
  "write:admin:relays": "リレーを操作する"
  "read:admin:relays": "リレーを見る"
  "write:admin:invite-codes": "招待コードを操作する"
  "read:admin:invite-codes": "招待コードを見る"
  "write:admin:announcements": "お知らせを操作する"
  "read:admin:announcements": "お知らせを見る"
  "write:admin:avatar-decorations": "アバターデコレーションを操作する"
  "read:admin:avatar-decorations": "アバターデコレーションを見る"
  "write:admin:federation": "連合に関する情報を操作する"
  "write:admin:account": "ユーザーアカウントを操作する"
  "read:admin:account": "ユーザーに関する情報を見る"
  "write:admin:emoji": "絵文字を操作する"
  "read:admin:emoji": "絵文字を見る"
  "write:admin:queue": "ジョブキューを操作する"
  "read:admin:queue": "ジョブキューに関する情報を見る"
  "write:admin:promo": "プロモーションノートを操作する"
  "write:admin:drive": "ユーザーのドライブを操作する"
  "read:admin:drive": "ユーザーのドライブの関する情報を見る"
  "read:admin:stream": "管理者用のWebsocket APIを使う"
  "write:admin:ad": "広告を操作する"
  "read:admin:ad": "広告を見る"
  "write:invite-codes": "招待コードを作成する"
  "read:invite-codes": "招待コードを取得する"
  "write:clip-favorite": "クリップのいいねを操作する"
  "read:clip-favorite": "クリップのいいねを見る"
  "read:federation": "連合に関する情報を取得する"
  "write:report-abuse": "違反を報告する"
		if (token && ((ep.meta.kind && !token.permission.some(p => p === ep.meta.kind))
			|| (!ep.meta.kind && (ep.meta.requireCredential || ep.meta.requireModerator || ep.meta.requireAdmin)))) {

				if (app !== null && !app.permission.some(p => p === 'read:account')) {
					throw new AuthenticationError('Your app does not have necessary permissions to use websocket API.');
				}
import { permissions } from 'misskey-js';
interface IEndpointMetaBase {
export type IEndpointMeta = (Omit<IEndpointMetaBase, 'requireCrential' | 'requireModerator' | 'requireAdmin'> & {
	requireCredential?: false,
	requireAdmin?: false,
	requireModerator?: false,
}) | (Omit<IEndpointMetaBase, 'secure'> & {
	secure: true,
}) | (Omit<IEndpointMetaBase, 'requireCredential' | 'kind'> & {
	requireCredential: true,
	kind: (typeof permissions)[number],
}) | (Omit<IEndpointMetaBase, 'requireModerator' | 'kind'> & {
	requireModerator: true,
	kind: (typeof permissions)[number],
}) | (Omit<IEndpointMetaBase, 'requireAdmin' | 'kind'> & {
	requireAdmin: true,
	kind: (typeof permissions)[number],
})

	kind: 'read:admin:abuse-user-reports',
	secure: true,
	kind: 'write:admin:account',
	kind: 'read:admin:account',
	kind: 'write:admin:ad',
	kind: 'write:admin:ad',
	kind: 'read:admin:ad',
	kind: 'write:admin:ad',
	kind: 'write:admin:announcements',
	kind: 'write:admin:announcements',
	kind: 'read:admin:announcements',
	kind: 'write:admin:announcements',
	kind: 'write:admin:avatar-decorations',
	kind: 'write:admin:avatar-decorations',
	kind: 'read:admin:avatar-decorations',
	kind: 'write:admin:avatar-decorations',
	kind: 'write:admin:delete-account',
	kind: 'write:admin:delete-all-files-of-a-user',
	kind: 'write:admin:drive',
	kind: 'write:admin:drive',
	kind: 'read:admin:drive',
	kind: 'read:admin:drive',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	secure: true,
	kind: 'read:admin:emoji',
	kind: 'read:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:emoji',
	kind: 'write:admin:federation',
	kind: 'write:admin:federation',
	kind: 'write:admin:federation',
	kind: 'write:admin:federation',
	kind: 'read:admin:index-stats',
	kind: 'read:admin:table-stats',
	kind: 'read:admin:user-ips',
	},
	kind: 'write:admin:invite-codes',
	kind: 'read:admin:invite-codes',
	kind: 'read:admin:meta',
	kind: 'write:admin:promo',
	kind: 'write:admin:queue',
	kind: 'read:admin:queue',
	kind: 'read:admin:queue',
	kind: 'write:admin:queue',
	kind: 'read:admin:emoji',
	kind: 'write:admin:relays',
	kind: 'read:admin:relays',
	kind: 'write:admin:relays',
	kind: 'write:admin:reset-password',
	kind: 'write:admin:resolve-abuse-user-report',
	kind: 'write:admin:roles',
	kind: 'write:admin:roles',
	kind: 'write:admin:roles',
	kind: 'read:admin:roles',
	kind: 'read:admin:roles',
	kind: 'write:admin:roles',
	kind: 'write:admin:roles',
	kind: 'write:admin:roles',
	kind: 'read:admin:roles',
	kind: 'write:admin:send-email',
	kind: 'read:admin:server-info',
	kind: 'read:admin:show-moderation-log',
	kind: 'read:admin:show-user',
	kind: 'read:admin:show-users',
	kind: 'write:admin:suspend-user',
	kind: 'write:admin:unset-user-avatar',
	kind: 'write:admin:unset-user-banner',
	kind: 'write:admin:unsuspend-user',
	kind: 'write:admin:meta',
	kind: 'write:admin:user-note',
	kind: 'read:federation',
	kind: 'read:account',
	requireCredential: false,
	secure: true,
	kind: "read:account",
	kind: 'write:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'write:account',
	kind: 'write:account',
	kind: 'write:invite-codes',
	kind: 'write:invite-codes',
	kind: 'read:invite-codes',
	kind: 'read:invite-codes',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'read:account',
	kind: 'write:account',
	kind: 'read:account',
	kind: 'read:account',
	secure: true,
	secure: true,
	secure: true,
	requireCredential: false,
	},
	kind: 'write:account',
	kind: 'write:account',
	kind: 'write:account',
	kind: 'read:account',
	kind: 'write:report-abuse',
import { type MiChannelService } from './channel.js';
	public getChannelService(name: string): MiChannelService<boolean> {
		if (this.token && ((channelService.kind && !this.token.permission.some(p => p === channelService.kind))
			|| (!channelService.kind && channelService.requireCredential))) {
			return;
		}

	public static readonly kind?: string | null;

export type MiChannelService<T extends boolean> = {
	shouldShare: boolean;
	requireCredential: T;
	kind: T extends true ? string : string | null | undefined;
	create: (id: string, connection: Connection) => Channel;
}
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:admin:stream';
export class AdminChannelService implements MiChannelService<true> {
	public readonly kind = AdminChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:account';
export class AntennaChannelService implements MiChannelService<true> {
	public readonly kind = AntennaChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class ChannelChannelService implements MiChannelService<false> {
	public readonly kind = ChannelChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:account';
export class DriveChannelService implements MiChannelService<true> {
	public readonly kind = DriveChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class GlobalTimelineChannelService implements MiChannelService<false> {
	public readonly kind = GlobalTimelineChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class HashtagChannelService implements MiChannelService<false> {
	public readonly kind = HashtagChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:account';
export class HomeTimelineChannelService implements MiChannelService<true> {
	public readonly kind = HomeTimelineChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:account';
export class HybridTimelineChannelService implements MiChannelService<true> {
	public readonly kind = HybridTimelineChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class LocalTimelineChannelService implements MiChannelService<false> {
	public readonly kind = LocalTimelineChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = true as const;
	public static kind = 'read:account';
export class MainChannelService implements MiChannelService<true> {
	public readonly kind = MainChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class QueueStatsChannelService implements MiChannelService<false> {
	public readonly kind = QueueStatsChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class RoleTimelineChannelService implements MiChannelService<false> {
	public readonly kind = RoleTimelineChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class ServerStatsChannelService implements MiChannelService<false> {
	public readonly kind = ServerStatsChannel.kind;
import Channel, { type MiChannelService } from '../channel.js';
	public static requireCredential = false as const;
export class UserListChannelService implements MiChannelService<false> {
	public readonly kind = UserListChannel.kind;
import { permissions as kinds } from 'misskey-js';
					const scopes = [...new Set(scope)].filter(s => (<readonly string[]>kinds).includes(s));
import { signup, api, startServer, successfulApiCall, failedApiCall, uploadFile, waitFire, connectStream, relativeFetch, createAppToken } from '../utils.js';
		const application = await createAppToken(alice, ['read:account']);
		const application2 = await createAppToken(alice, ['read:admin:index-stats']);
		const application3 = await createAppToken(bob, []);
		const application4 = await createAppToken(bob, ['read:admin:index-stats']);


		await successfulApiCall({
			endpoint: '/admin/get-index-stats',
			parameters: {},
			user: { token: application2 },
		});

		await failedApiCall({
			endpoint: '/admin/get-index-stats',
			parameters: {},
			user: { token: application },
		}, {
			status: 403,
			code: 'PERMISSION_DENIED',
			id: '1370e5b7-d4eb-4566-bb1d-7748ee6a1838',
		});

		await failedApiCall({
			endpoint: '/admin/get-index-stats',
			parameters: {},
			user: { token: application3 },
		}, {
			status: 403,
			code: 'ROLE_PERMISSION_DENIED',
			id: 'c3d38592-54c0-429d-be96-5636b0431a61',
		});

		await failedApiCall({
			endpoint: '/admin/get-index-stats',
			parameters: {},
			user: { token: application4 },
		}, {
			status: 403,
			code: 'ROLE_PERMISSION_DENIED',
			id: 'c3d38592-54c0-429d-be96-5636b0431a61',
		});
import { WebSocket } from 'ws';
import { signup, api, post, startServer, initTestDb, waitFire, createAppToken, port } from '../utils.js';
		test('Authentication', async () => {
			const application = await createAppToken(ayano, []);
			const application2 = await createAppToken(ayano, ['read:account']);
			const socket = new WebSocket(`ws://127.0.0.1:${port}/streaming?i=${application}`);
			const established = await new Promise<boolean>((resolve, reject) => {
				socket.on('error', () => resolve(false));
				socket.on('unexpected-response', () => resolve(false));
				setTimeout(() => resolve(true), 3000);
			});

			socket.close();
			assert.strictEqual(established, false);

			const fired = await waitFire(
				{ token: application2 }, 'hybridTimeline',
				() => api('notes/create', { text: 'Hello, world!' }, ayano),
				msg => msg.type === 'note' && msg.body.userId === ayano.id,
			);

			assert.strictEqual(fired, true);
		});

import { randomUUID } from 'node:crypto';
export const createAppToken = async (user: UserToken, permissions: (typeof misskey.permissions)[number][]) => {
	const res = await api('miauth/gen-token', {
		session: randomUUID(),
		permission: permissions,
	}, user);

	return (res.body as misskey.entities.MiauthGenTokenResponse).token;
};

				<MkSwitch v-for="kind in Object.keys(permissions)" :key="kind" v-model="permissions[kind]">{{ i18n.t(`_permissions.${kind}`) }}</MkSwitch>
	initialPermissions?: (typeof Misskey.permissions)[number][] | null;
const defaultPermissions = Misskey.permissions.filter(p => !p.startsWith('read:admin') && !p.startsWith('write:admin'));
const permissions = ref(<Record<(typeof Misskey.permissions)[number], boolean>>{});
	for (const kind of defaultPermissions) {
 * generatedAt: 2023-12-26T23:35:09.494Z
     * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
     * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *No*
     * **Credential required**: *Yes* / **Permission**: *write:admin:account*
     * **Credential required**: *Yes* / **Permission**: *read:admin:account*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *Yes*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
     * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
     * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
     * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
     * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
     * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
     * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
     * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
     * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *No* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:federation*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *No*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
     * **Credential required**: *No*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
 * generatedAt: 2023-12-26T23:35:09.491Z
 * generatedAt: 2023-12-26T23:35:09.489Z
 * generatedAt: 2023-12-26T23:35:09.485Z
 * generatedAt: 2023-12-26T23:35:09.389Z
     * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
     * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *No*
     * **Credential required**: *Yes* / **Permission**: *write:admin:account*
     * **Credential required**: *Yes* / **Permission**: *read:admin:account*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *Yes*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
     * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
     * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
     * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
     * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
     * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
     * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
     * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
     * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
     * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
     * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
     * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
     * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
     * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
     * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
     * **Credential required**: *No* / **Permission**: *read:admin:roles*
     * **Credential required**: *Yes* / **Permission**: *read:federation*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *No*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *write:account*
     * **Credential required**: *Yes* / **Permission**: *read:account*
     * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
     * **Credential required**: *No*
     * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Credential required**: *Yes* / **Permission**: *read:admin:meta*
   * **Credential required**: *Yes* / **Permission**: *read:admin:abuse-user-reports*
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Credential required**: *No*
   * **Credential required**: *Yes* / **Permission**: *write:admin:account*
   * **Credential required**: *Yes* / **Permission**: *read:admin:account*
   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
   * **Credential required**: *Yes* / **Permission**: *read:admin:ad*
   * **Credential required**: *Yes* / **Permission**: *write:admin:ad*
   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
   * **Credential required**: *Yes* / **Permission**: *read:admin:announcements*
   * **Credential required**: *Yes* / **Permission**: *write:admin:announcements*
   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
   * **Credential required**: *Yes* / **Permission**: *read:admin:avatar-decorations*
   * **Credential required**: *Yes* / **Permission**: *write:admin:avatar-decorations*
   * **Credential required**: *Yes* / **Permission**: *write:admin:delete-all-files-of-a-user*
   * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-avatar*
   * **Credential required**: *Yes* / **Permission**: *write:admin:unset-user-banner*
   * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
   * **Credential required**: *Yes* / **Permission**: *write:admin:drive*
   * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
   * **Credential required**: *Yes* / **Permission**: *read:admin:drive*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Credential required**: *Yes*
   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
   * **Credential required**: *Yes* / **Permission**: *write:admin:federation*
   * **Credential required**: *Yes* / **Permission**: *read:admin:index-stats*
   * **Credential required**: *Yes* / **Permission**: *read:admin:table-stats*
   * **Credential required**: *Yes* / **Permission**: *read:admin:user-ips*
   * **Credential required**: *Yes* / **Permission**: *write:admin:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *read:admin:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *write:admin:promo*
   * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
   * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
   * **Credential required**: *Yes* / **Permission**: *read:admin:queue*
   * **Credential required**: *Yes* / **Permission**: *write:admin:queue*
   * **Credential required**: *Yes* / **Permission**: *read:admin:emoji*
   * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
   * **Credential required**: *Yes* / **Permission**: *read:admin:relays*
   * **Credential required**: *Yes* / **Permission**: *write:admin:relays*
   * **Credential required**: *Yes* / **Permission**: *write:admin:reset-password*
   * **Credential required**: *Yes* / **Permission**: *write:admin:resolve-abuse-user-report*
   * **Credential required**: *Yes* / **Permission**: *write:admin:send-email*
   * **Credential required**: *Yes* / **Permission**: *read:admin:server-info*
   * **Credential required**: *Yes* / **Permission**: *read:admin:show-moderation-log*
   * **Credential required**: *Yes* / **Permission**: *read:admin:show-user*
   * **Credential required**: *Yes* / **Permission**: *read:admin:show-users*
   * **Credential required**: *Yes* / **Permission**: *write:admin:suspend-user*
   * **Credential required**: *Yes* / **Permission**: *write:admin:unsuspend-user*
   * **Credential required**: *Yes* / **Permission**: *write:admin:meta*
   * **Credential required**: *Yes* / **Permission**: *write:admin:delete-account*
   * **Credential required**: *Yes* / **Permission**: *write:admin:user-note*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *read:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *write:admin:roles*
   * **Credential required**: *No* / **Permission**: *read:admin:roles*
   * **Credential required**: *Yes* / **Permission**: *read:federation*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *No*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *write:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *read:invite-codes*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *write:account*
   * **Credential required**: *Yes* / **Permission**: *read:account*
   * **Credential required**: *Yes* / **Permission**: *write:report-abuse*
   * **Credential required**: *No*
   * **Internal Endpoint**: This endpoint is an API for the misskey mainframe and is not intended for use by third parties.
	'read:admin:abuse-user-reports',
	'write:admin:delete-account',
	'write:admin:delete-all-files-of-a-user',
	'read:admin:index-stats',
	'read:admin:table-stats',
	'read:admin:user-ips',
	'read:admin:meta',
	'write:admin:reset-password',
	'write:admin:resolve-abuse-user-report',
	'write:admin:send-email',
	'read:admin:server-info',
	'read:admin:show-moderation-log',
	'read:admin:show-user',
	'read:admin:show-users',
	'write:admin:suspend-user',
	'write:admin:unset-user-avatar',
	'write:admin:unset-user-banner',
	'write:admin:unsuspend-user',
	'write:admin:meta',
	'write:admin:user-note',
	'write:admin:roles',
	'read:admin:roles',
	'write:admin:relays',
	'read:admin:relays',
	'write:admin:invite-codes',
	'read:admin:invite-codes',
	'write:admin:announcements',
	'read:admin:announcements',
	'write:admin:avatar-decorations',
	'read:admin:avatar-decorations',
	'write:admin:federation',
	'write:admin:account',
	'read:admin:account',
	'write:admin:emoji',
	'read:admin:emoji',
	'write:admin:queue',
	'read:admin:queue',
	'write:admin:promo',
	'write:admin:drive',
	'read:admin:drive',
	'write:admin:ad',
	'read:admin:ad',
	'write:invite-codes',
	'read:invite-codes',
	'write:clip-favorite',
	'read:clip-favorite',
	'read:federation',
	'write:report-abuse',
] as const;