# API connection: permissions and presets Source: https://listplus.ai/en/help/ai-agents-api/api-permissions Last updated: 2026-10-15 Every connection's **Permissions** tab controls exactly what an agent can see and do in that one list. Start from a preset, then adjust. Choosing a preset also resets Visible Columns (all visible again), Write Protection, Deduplicate by and Record Quality, and turns all research tools on — check those sections after picking one. ## Presets | Preset | What it turns on | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Read Only** | Query, count, run quality checks. No adding, editing or enrichment (research tools stay on unless you uncheck them) | | **Data Assistant** | Query, count, edit, ignore, tags, status, quality checks. No adding, no enrichment | | **Enrichment** | Query, count, edit (empty cells only), quality checks, plus six enrichment types: Company Profile, LinkedIn Profile (by LinkedIn URL), LinkedIn URL (by Name & Company), LinkedIn Profile Search (by Name & Company), Contact Profile (by Email), Contact Profile (by Name & Company) | | **Data Collector** | Add, query, count, ignore, tags, Company Profile, all research tools. Makes all columns visible, limits writing to typical lead columns, deduplicates by the LinkedIn column if there is one | | **Full Access** | All actions including setting the status, AI column filling and creating/deleting its own columns, plus the same six enrichment types (not Contact Brief) | | **Custom** | Your own combination — selected automatically once you change anything a preset doesn't match | A brand-new connection can add, query, count, tag and ignore records, look up Company Profiles, and use the research tools, including the paid ones. Editing records, AI column filling and the other enrichment types stay off until you turn them on. Review the Permissions tab before you share the URL. ## Actions The core actions are **Add records**, **Query records**, **Count records**, **Edit records**, **Ignore records** and **Manage tags** — on a new connection add, query, count, ignore and tags start on; only **Edit records** stays off until you allow it (as do Set status, Hand over to pipelines, AI column filling and Run quality checks below). Two more switches matter beyond basic data access: - **Set status** — lets the agent set a record's list status (for example "Qualified") and read, query and count records by status. Off on a new connection. The agent can only use statuses the list already has; it cannot create new ones, and a hidden record keeps being hidden. A status the agent sets can start the list's triggers, exactly as if you had set it. - **Hand over to pipelines** — tick the pipelines this connection may hand records to. None are ticked on a new connection, and a preset never ticks one. The agent sees only the ticked pipelines. Handing over works like **Add to pipeline** in the app: the pipeline's data check and its release mode stay in force, so in a pipeline with manual release the records wait for your click on Send. - **AI column filling** — lets the agent fill a column with AI-derived values (for example gender from a name, or continent from a country). - **Run quality checks** — ListPlus's deterministic data-quality checks; free, no credits. Off on a new connection. Free research tools (**Google Search**, **Hacker News Search**, **Website Scrape**) and paid ones (**Reddit Search**, **Twitter/X Search**) are each their own switch, so you can allow research without allowing enrichment or vice versa — all five are on by default on a new connection. **Create columns** lets the agent add new columns to the list's schema (with an optional cap and permission to delete only columns it created itself). ## Enrichment types Only **Company Profile** is allowed by default. Each type you check is a separate lookup with its own credit cost, shown next to the checkbox — for example Company Profile, LinkedIn Profile (by LinkedIn URL), LinkedIn Profile Search (by Name & Company), Contact Brief (by LinkedIn URL or Name & Company), and Contact Profile (by Email or by Name & Company). Only checked types are available to the agent; the exact credit amounts and when they're charged are the same as everywhere else in ListPlus — see "[What does one contact cost?](https://listplus.ai/en/help/plans-credits-billing/what-does-one-contact-cost)" and the price list. A connected **Max records per enrich request** setting caps how many rows one enrichment call can touch at once. A provider the workspace owner switched off in the workspace policy is refused even when its type is ticked here. ## Data safety controls - **Sublist Visibility** (when your list has sublists) limits the connection to the records that match the sublists you select; leave none selected to see everything. The limit is checked live on every request: a record is visible as soon as it matches the sublist's rule and stops being visible when it no longer does — there is nothing to refresh. It is bound to the sublist itself, so renaming the sublist changes nothing. If the sublist is gone, the agent sees no records at all. A record the agent adds is visible to it only if it matches the rule. An agent can't put records into a sublist; it marks them with tags. - **Visible Columns** lets you hide specific columns from the agent entirely — it never sees or receives them. New connections hide likely email, name and phone columns automatically; you can uncheck any column to hide it, or re-check it to reveal it. - **Write Protection** offers **Only fill empty cells** (updates can't overwrite a value that's already there) plus a column-by-column whitelist of which columns the agent is even allowed to write to; leave the whitelist empty to allow writing to any visible column. - **Record Quality** rejects incoming records that aren't identifiable enough: **Accept all**, **Person identity required** (default — a valid email, LinkedIn URL, or name plus company), **Company identity required**, **Person or company**, or **Custom rules** where you pick specific checks yourself. ## Deduplication and default values **Deduplicate by** turns the duplicate check on: a new record that is already in the list (same email, LinkedIn URL, or name plus company) is not added again — it fills the existing record's empty cells and counts as `rowsMerged` in the response. A connection limited to sublists always adds new records. **Default Values** auto-fills fixed values into specific columns on every record the agent adds — useful for tagging where a batch of records came from. **Related topics:** api-connection-overview · api-connection-setup · api-costs-and-security · what-the-ai-sees · price-list · list-statuses · pipelines-overview. ## FAQ ### What permission presets can I start from? Six: Read Only, Data Assistant, Enrichment, Data Collector, Full Access, and Custom (selected automatically once your settings don't match any preset) — see the preset table above for what each one turns on. ### What actions can I individually allow or block? Add records, Query records, Count records, Edit records, Ignore records, Manage tags and Set status, plus handing records to the pipelines you tick, AI column filling, running quality checks, creating columns, and each research tool (Google Search, Hacker News Search, Website Scrape, Reddit Search, Twitter/X Search) are each their own switch — turn on only what that agent needs. ### Can an AI agent set the status of a record? Yes, if you turn on Set status in the connection's Permissions tab (it is off on a new connection). The agent can then set any status the list has, clear it, and query or count records by status. It cannot create new statuses and cannot unhide a hidden record this way. ### Can an AI agent send records to a pipeline? Yes, if you tick the pipelines it may use under Hand over to pipelines in the connection's Permissions tab — none are ticked by default. The agent can then list those pipelines and hand records of its list to them, up to 500 per call. Their data check and release mode apply as in the app, so with manual release the records wait until you click Send. ### Which enrichment lookups can an agent use, and how do I turn them on? Only Company Profile is allowed by default. On the Permissions tab's Enrichment section, check each other lookup you want to allow (for example Contact Profile by Email) — each shows its own credit cost — and set a maximum records-per-request if you want to cap how much one call can spend. ### Can I hide specific columns from the agent? Yes. Visible Columns lets you uncheck any column so the agent never sees or receives it; new connections hide likely email, name and phone columns by default, and you can adjust that per connection. ### Can I stop the agent from overwriting data that's already there? Yes, with Only fill empty cells, which restricts updates to blank values only. You can also whitelist exactly which columns the agent is allowed to write to at all — leaving that list empty allows writing to any visible column. ### What does "Record Quality" do? It rejects incoming records the agent tries to add that aren't identifiable enough, based on a mode you pick: Accept all, Person identity required (the default — needs a valid email, LinkedIn URL, or name plus company), Company identity required, Person or company, or a Custom set of rules you choose yourself. ### Can I restrict a connection to only part of my list? Yes, if your list has sublists — Sublist Visibility lets you select which ones the connection can see; with none selected, it sees the whole list. The limit is checked live on every request against the sublist's rule, so there is no snapshot and nothing to refresh. ### What happens to an agent when I rename or delete the sublist it is limited to? Renaming is harmless — the limit is bound to the sublist itself, not to its name. Deleting is refused while an agent is limited to the sublist; the message names the agent. If the sublist no longer exists anyway, the agent sees no records until you change its Sublist Visibility. ### Can an agent add records to a sublist? No. A sublist is a saved rule, so nobody adds records to it by hand — not you and not an agent. An agent marks records with tags (Manage tags); a sublist with the rule "Tags is one of …" then shows them. A record an agent adds is visible to a sublist-limited agent only if it matches that sublist's rule. ### Can I stop duplicate records, or auto-fill a value on everything an agent adds? Deduplicate by turns the duplicate check on: a record already in the list (same email, LinkedIn URL, or name plus company) is not added again but fills the existing record's empty cells. Default Values auto-fills fixed values into chosen columns on every record the agent adds, regardless of what it sends.