1# @ohos.abilityAccessCtrl (Application Access Control) (System API) 2 3The **abilityAccessCtrl** module provides APIs for application permission management, including authentication, authorization, and revocation. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 8. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> - This topic describes only the system APIs provided by the module. For details about its public APIs, see [@ohos.abilityAccessCtrl (Application Access Control)](js-apis-abilityAccessCtrl.md). 9 10## Modules to Import 11 12```ts 13import { abilityAccessCtrl } from '@kit.AbilityKit' 14``` 15 16## AtManager 17 18Provides APIs for application access control. 19 20### grantUserGrantedPermission 21 22grantUserGrantedPermission(tokenID: number, permissionName: Permissions, permissionFlags: number): Promise<void> 23 24Grants a user_grant permission to an application. This API uses a promise to return the result. 25 26**System API**: This is a system API. 27 28**Required permissions**: ohos.permission.GRANT_SENSITIVE_PERMISSIONS (available only to system applications) 29 30**System capability**: SystemCapability.Security.AccessToken 31 32**Parameters** 33 34| Name | Type | Mandatory| Description | 35| --------- | ------------------- | ---- | ------------------------------------------------------------ | 36| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 37| permissionName | Permissions | Yes | Permission to grant. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 38| permissionFlags | number | Yes | Permission flag.<br>- **1**: A dialog box for user authorization will be displayed the next time if the user denies authorization for the permission.<br>- **2**: No dialog box will be displayed the next time if the user denies authorization for the permission. The permission must be granted by the user in **Settings**.<br>- **64**: The permission is granted to the user only this time. The authorization is revoked after the application switches to the background or exits.| 39 40**Return value** 41 42| Type | Description | 43| :------------ | :---------------------------------- | 44| Promise<void> | Promise that returns no value.| 45 46**Error codes** 47 48For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 49 50| ID| Error Message| 51| -------- | -------- | 52| 201 | Permission denied. Interface caller does not have permission. | 53| 202 | Not System App. Interface caller is not a system app. | 54| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 55| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters, or the flags value is invalid. | 56| 12100002 | The specified tokenID does not exist. | 57| 12100003 | The specified permission does not exist. | 58| 12100006 | The application specified by the tokenID is not allowed to be granted with the specified permission. Either the application is a sandbox or the tokenID is from a remote device. | 59| 12100007 | The service is abnormal. | 60 61**Example** 62 63```ts 64import { abilityAccessCtrl } from '@kit.AbilityKit'; 65import { BusinessError } from '@kit.BasicServicesKit'; 66 67let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 68let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 69let permissionFlags: number = 1; 70atManager.grantUserGrantedPermission(tokenID, 'ohos.permission.READ_AUDIO', permissionFlags).then(() => { 71 console.log('grantUserGrantedPermission success'); 72}).catch((err: BusinessError) => { 73 console.error(`grantUserGrantedPermission fail, err->${JSON.stringify(err)}`); 74}); 75``` 76 77### grantUserGrantedPermission 78 79grantUserGrantedPermission(tokenID: number, permissionName: Permissions, permissionFlags: number, callback: AsyncCallback<void>): void 80 81Grants a user_grant permission to an application. This API uses an asynchronous callback to return the result. 82 83**System API**: This is a system API. 84 85**Required permissions**: ohos.permission.GRANT_SENSITIVE_PERMISSIONS (available only to system applications) 86 87**System capability**: SystemCapability.Security.AccessToken 88 89**Parameters** 90 91| Name | Type | Mandatory| Description | 92| --------- | ------------------- | ---- | ------------------------------------------------------------ | 93| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 94| permissionName | Permissions | Yes | Permission to grant. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 95| permissionFlags | number | Yes | Permission flag.<br>- **1**: A dialog box for user authorization will be displayed the next time if the user denies authorization for the permission.<br>- **2**: No dialog box will be displayed the next time if the user denies authorization for the permission. The permission must be granted by the user in **Settings**.<br>- **64**: The permission is granted to the user only this time. The authorization is revoked after the application switches to the background or exits.| 96| callback | AsyncCallback<void> | Yes| Callback used to return the result. If the permission is granted, **err** is **undefined**. Otherwise, **err** is an error object.| 97 98**Error codes** 99 100For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 101 102| ID| Error Message| 103| -------- | -------- | 104| 201 | Permission denied. Interface caller does not have permission. | 105| 202 | Not System App. Interface caller is not a system app. | 106| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 107| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters, or the flags value is invalid. | 108| 12100002 | The specified tokenID does not exist. | 109| 12100003 | The specified permission does not exist. | 110| 12100006 | The application specified by the tokenID is not allowed to be granted with the specified permission. Either the application is a sandbox or the tokenID is from a remote device. | 111| 12100007 | The service is abnormal. | 112 113**Example** 114 115```ts 116import { abilityAccessCtrl } from '@kit.AbilityKit'; 117import { BusinessError } from '@kit.BasicServicesKit'; 118 119let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 120let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 121let permissionFlags: number = 1; 122atManager.grantUserGrantedPermission(tokenID, 'ohos.permission.READ_AUDIO', permissionFlags, (err: BusinessError, data: void) => { 123 if (err) { 124 console.error(`grantUserGrantedPermission fail, err->${JSON.stringify(err)}`); 125 } else { 126 console.log('grantUserGrantedPermission success'); 127 } 128}); 129``` 130 131### revokeUserGrantedPermission 132 133revokeUserGrantedPermission(tokenID: number, permissionName: Permissions, permissionFlags: number): Promise<void> 134 135Revokes a user_grant permission from an application. This API uses a promise to return the result. 136 137**System API**: This is a system API. 138 139**Required permissions**: ohos.permission.REVOKE_SENSITIVE_PERMISSIONS (available only to system applications) 140 141**System capability**: SystemCapability.Security.AccessToken 142 143**Parameters** 144 145| Name | Type | Mandatory| Description | 146| --------- | ------------------- | ---- | ------------------------------------------------------------ | 147| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 148| permissionName | Permissions | Yes | Permission to revoke. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 149| permissionFlags | number | Yes | Permission flag.<br>- **1**: A dialog box for user authorization will be displayed the next time if the user denies authorization for the permission.<br>- **2**: No dialog box will be displayed the next time if the user denies authorization for the permission. The permission must be granted by the user in **Settings**.<br>- **64**: The permission is granted to the user only this time. The authorization is revoked after the application switches to the background or exits.| 150 151**Return value** 152 153| Type | Description | 154| :------------ | :---------------------------------- | 155| Promise<void> | Promise that returns no value.| 156 157**Error codes** 158 159For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 160 161| ID| Error Message| 162| -------- | -------- | 163| 201 | Permission denied. Interface caller does not have permission. | 164| 202 | Not System App. Interface caller is not a system app. | 165| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 166| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters, or the flags value is invalid. | 167| 12100002 | The specified tokenID does not exist. | 168| 12100003 | The specified permission does not exist. | 169| 12100006 | The application specified by the tokenID is not allowed to be revoked with the specified permission. Either the application is a sandbox or the tokenID is from a remote device. | 170| 12100007 | The service is abnormal. | 171 172**Example** 173 174```ts 175import { abilityAccessCtrl } from '@kit.AbilityKit'; 176import { BusinessError } from '@kit.BasicServicesKit'; 177 178let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 179let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 180let permissionFlags: number = 1; 181atManager.revokeUserGrantedPermission(tokenID, 'ohos.permission.READ_AUDIO', permissionFlags).then(() => { 182 console.log('revokeUserGrantedPermission success'); 183}).catch((err: BusinessError) => { 184 console.error(`revokeUserGrantedPermission fail, err->${JSON.stringify(err)}`); 185}); 186``` 187 188### revokeUserGrantedPermission 189 190revokeUserGrantedPermission(tokenID: number, permissionName: Permissions, permissionFlags: number, callback: AsyncCallback<void>): void 191 192Revokes a user_grant permission from an application. This API uses an asynchronous callback to return the result. 193 194**System API**: This is a system API. 195 196**Required permissions**: ohos.permission.REVOKE_SENSITIVE_PERMISSIONS (available only to system applications) 197 198**System capability**: SystemCapability.Security.AccessToken 199 200**Parameters** 201 202| Name | Type | Mandatory| Description | 203| --------- | ------------------- | ---- | ------------------------------------------------------------ | 204| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 205| permissionName | Permissions | Yes | Permission to revoke. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 206| permissionFlags | number | Yes | Permission flag.<br>- **1**: A dialog box for user authorization will be displayed the next time if the user denies authorization for the permission.<br>- **2**: No dialog box will be displayed the next time if the user denies authorization for the permission. The permission must be granted by the user in **Settings**.<br>- **64**: The permission is granted to the user only this time. The authorization is revoked after the application switches to the background or exits.| 207| callback | AsyncCallback<void> | Yes| Callback used to return the result. If the permission is successfully revoked, **err** is **undefined**. Otherwise, **err** is an error object.| 208 209**Error codes** 210 211For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 212 213| ID| Error Message| 214| -------- | -------- | 215| 201 | Permission denied. Interface caller does not have permission. | 216| 202 | Not System App. Interface caller is not a system app. | 217| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 218| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters, or the flags value is invalid. | 219| 12100002 | The specified tokenID does not exist. | 220| 12100003 | The specified permission does not exist. | 221| 12100006 | The application specified by the tokenID is not allowed to be revoked with the specified permission. Either the application is a sandbox or the tokenID is from a remote device. | 222| 12100007 | The service is abnormal. | 223 224**Example** 225 226```ts 227import { abilityAccessCtrl } from '@kit.AbilityKit'; 228import { BusinessError } from '@kit.BasicServicesKit'; 229 230let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 231let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 232let permissionFlags: number = 1; 233atManager.revokeUserGrantedPermission(tokenID, 'ohos.permission.READ_AUDIO', permissionFlags, (err: BusinessError, data: void) => { 234 if (err) { 235 console.error(`revokeUserGrantedPermission fail, err->${JSON.stringify(err)}`); 236 } else { 237 console.log('revokeUserGrantedPermission success'); 238 } 239}); 240``` 241 242### getPermissionFlags 243 244getPermissionFlags(tokenID: number, permissionName: Permissions): Promise<number> 245 246Obtains the flag of the specified permission of an application. This API uses a promise to return the result. 247 248**System API**: This is a system API. 249 250**Required permissions**: ohos.permission.GET_SENSITIVE_PERMISSIONS, ohos.permission.GRANT_SENSITIVE_PERMISSIONS, or ohos.permission.REVOKE_SENSITIVE_PERMISSIONS (available only to system applications) 251 252**System capability**: SystemCapability.Security.AccessToken 253 254**Parameters** 255 256| Name | Type | Mandatory| Description | 257| --------- | ------------------- | ---- | ------------------------------------------------------------ | 258| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 259| permissionName | Permissions | Yes | Permission whose flag is to be obtained. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 260 261**Return value** 262 263| Type | Description | 264| :------------ | :---------------------------------- | 265| Promise<number> | Promise used to return the flag obtained.| 266 267**Error codes** 268 269For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 270 271| ID| Error Message| 272| -------- | -------- | 273| 201 | Permission denied. Interface caller does not have permission. | 274| 202 | Not System App. Interface caller is not a system app. | 275| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 276| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters. | 277| 12100002 | The specified tokenID does not exist. | 278| 12100003 | The specified permission does not exist. | 279| 12100006 | The operation is not allowed. Either the application is a sandbox or the tokenID is from a remote device. | 280| 12100007 | The service is abnormal. | 281 282**Example** 283 284```ts 285import { abilityAccessCtrl } from '@kit.AbilityKit'; 286import { BusinessError } from '@kit.BasicServicesKit'; 287 288let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 289let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 290atManager.getPermissionFlags(tokenID, 'ohos.permission.GRANT_SENSITIVE_PERMISSIONS').then((data: number) => { 291 console.log(`getPermissionFlags success, data->${JSON.stringify(data)}`); 292}).catch((err: BusinessError) => { 293 console.error(`getPermissionFlags fail, err->${JSON.stringify(err)}`); 294}); 295``` 296 297### setPermissionRequestToggleStatus<sup>12+</sup> 298 299setPermissionRequestToggleStatus(permissionName: Permissions, status: PermissionRequestToggleStatus): Promise<void> 300 301Sets the toggle state of a permission. This API uses a promise to return the result. 302 303**System API**: This is a system API. 304 305**Required permissions**: ohos.permission.DISABLE_PERMISSION_DIALOG 306 307**System capability**: SystemCapability.Security.AccessToken 308 309**Parameters** 310 311| Name | Type | Mandatory| Description | 312| --------- | ------------------- | ---- | ------------------------------------------------------------ | 313| permissionName | Permissions | Yes | Permission to be set with the toggle state. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 314| status | [PermissionRequestToggleStatus](#permissionrequesttogglestatus12) | Yes | Toggle state to set. | 315 316**Return value** 317 318| Type | Description | 319| :------------ | :---------------------------------- | 320| Promise<void> | Promise that returns no value.| 321 322**Error codes** 323 324For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 325 326| ID| Error Message| 327| -------- | -------- | 328| 201 | Permission denied. Interface caller does not have permission. | 329| 202 | Not System App. Interface caller is not a system app. | 330| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 331| 12100001 | Invalid parameter. The permissionName exceeds 256 characters, or the status value is invalid. | 332| 12100003 | The specified permission does not exist. | 333| 12100007 | The service is abnormal. | 334 335**Example** 336 337```ts 338import { abilityAccessCtrl, Permissions } from '@kit.AbilityKit'; 339import { BusinessError } from '@kit.BasicServicesKit'; 340 341let atManager = abilityAccessCtrl.createAtManager(); 342let permission: Permissions = 'ohos.permission.CAMERA'; 343 344atManager.setPermissionRequestToggleStatus(permission, abilityAccessCtrl.PermissionRequestToggleStatus.CLOSED).then((err) => { 345 console.info('toggle_status: Set closed successful'); 346}).catch((err: BusinessError) => { 347 console.error('toggle_status: Code is ${err.code}, message is ${err.message}'); 348}); 349``` 350 351### getPermissionRequestToggleStatus<sup>12+</sup> 352 353getPermissionRequestToggleStatus(permissionName: Permissions): Promise<PermissionRequestToggleStatus> 354 355Obtains the toggle state of a permission. This API uses a promise to return the result. 356 357**System API**: This is a system API. 358 359**Required permissions**: ohos.permission.GET_SENSITIVE_PERMISSIONS 360 361**System capability**: SystemCapability.Security.AccessToken 362 363**Parameters** 364 365| Name | Type | Mandatory| Description | 366| --------- | ------------------- | ---- | ------------------------------------------------------------ | 367| permissionName | Permissions | Yes | Permission whose toggle state is to be obtained. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 368 369**Return value** 370 371| Type | Description | 372| :------------ | :---------------------------------- | 373| Promise<[PermissionRequestToggleStatus](#permissionrequesttogglestatus12)> | Promise used to return the toggle state obtained.| 374 375**Error codes** 376 377For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 378 379| ID| Error Message| 380| -------- | -------- | 381| 201 | Permission denied. Interface caller does not have permission. | 382| 202 | Not System App. Interface caller is not a system app. | 383| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 384| 12100001 | Invalid parameter. The permissionName exceeds 256 characters. | 385| 12100003 | The specified permission does not exist. | 386| 12100007 | The service is abnormal. | 387 388**Example** 389 390```ts 391import { abilityAccessCtrl, Permissions } from '@kit.AbilityKit'; 392import { BusinessError } from '@kit.BasicServicesKit'; 393 394let atManager = abilityAccessCtrl.createAtManager(); 395let permission: Permissions = 'ohos.permission.CAMERA'; 396 397atManager.getPermissionRequestToggleStatus(permission).then((res) => { 398 if (res == abilityAccessCtrl.PermissionRequestToggleStatus.CLOSED) { 399 console.info('toggle_status: The toggle status is close'); 400 } else { 401 console.info('toggle_status: The toggle status is open'); 402 } 403}).catch((err: BusinessError) => { 404console.error('toggle_status: Code is ${err.code}, message is ${err.message}'); 405}); 406``` 407 408### getVersion<sup>9+</sup> 409 410getVersion(): Promise<number> 411 412Obtains the data version of the permission management. This API uses a promise to return the result. 413 414**System API**: This is a system API. 415 416**System capability**: SystemCapability.Security.AccessToken 417 418**Return value** 419 420| Type | Description | 421| :------------ | :---------------------------------- | 422| Promise<number> | Promise used to return the version obtained.| 423 424| ID| Error Message| 425| -------- | -------- | 426| 202 | Not System App. Interface caller is not a system app. | 427 428**Example** 429 430```ts 431import { abilityAccessCtrl } from '@kit.AbilityKit'; 432 433let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 434let promise = atManager.getVersion(); 435promise.then((data: number) => { 436 console.log(`promise: data->${JSON.stringify(data)}`); 437}); 438``` 439 440### getPermissionsStatus<sup>12+</sup> 441 442getPermissionsStatus(tokenID: number, permissionList: Array<Permissions>): Promise<Array<PermissionStatus>> 443 444Obtains the status of the specified permissions. This API uses a promise to return the result. 445 446**System API**: This is a system API. 447 448**Required permissions**: ohos.permission.GET_SENSITIVE_PERMISSIONS (available only to system applications) 449 450**System capability**: SystemCapability.Security.AccessToken 451 452**Parameters** 453 454| Name | Type | Mandatory| Description | 455| --------- | ------------------- | ---- | ------------------------------------------------------------ | 456| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 457| permissionList | Array<Permissions> | Yes | Permissions whose status is to be obtained. For details, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 458 459**Return value** 460 461| Type | Description | 462| :------------ | :---------------------------------- | 463| Promise<Array<[PermissionStatus](#permissionstatus12)>> | Promise used to return the permission statuses obtained.| 464 465**Error codes** 466 467For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 468 469| ID| Error Message| 470| -------- | -------- | 471| 201 | Permission denied. Interface caller does not have permission. | 472| 202 | Not System App. Interface caller is not a system app. | 473| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 474| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters. | 475| 12100002 | The specified tokenID does not exist. | 476| 12100007 | The service is abnormal. | 477 478**Example** 479 480```ts 481import { abilityAccessCtrl } from '@kit.AbilityKit'; 482import { BusinessError } from '@kit.BasicServicesKit'; 483 484let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 485let tokenID: number = 0; // Use bundleManager.getApplicationInfo() to obtain the token ID for a system application, and use bundleManager.getBundleInfoForSelf() to obtain the token ID for a non-system application. 486atManager.getPermissionsStatus(tokenID, ['ohos.permission.CAMERA']).then((data: Array<abilityAccessCtrl.PermissionStatus>) => { 487 console.log(`getPermissionsStatus success, data->${JSON.stringify(data)}`); 488}).catch((err: BusinessError) => { 489 console.error(`getPermissionsStatus fail, err->${JSON.stringify(err)}`); 490}); 491``` 492 493### on<sup>9+</sup> 494 495on(type: 'permissionStateChange', tokenIDList: Array<number>, permissionList: Array<Permissions>, callback: Callback<PermissionStateChangeInfo>): void 496 497Subscribes to changes in the state of specified permissions for the given applications. 498 499Multiple callbacks can be registered for the specified **tokenIDList** and **permissionList**. 500 501If **tokenIDList** and **permissionList** have common values with the **tokenIDList** and **permissionList** of a callback registered, **callback** must be different. 502 503**System API**: This is a system API. 504 505**Required permissions**: ohos.permission.GET_SENSITIVE_PERMISSIONS (available only to system applications) 506 507**System capability**: SystemCapability.Security.AccessToken 508 509**Parameters** 510 511| Name | Type | Mandatory| Description | 512| ------------------ | --------------------- | ---- | ------------------------------------------------------------ | 513| type | string | Yes | Event type. The value is **'permissionStateChange'**, which indicates the permission state changes. | 514| tokenIDList | Array<number> | Yes | List of application token IDs. If this parameter is not specified, this API will subscribe to the permission state changes of all applications. | 515| permissionList | Array<Permissions> | Yes | List of target permissions. If this parameter is not specified, this API will subscribe to state changes of all permissions. For details about the permissions, see [Application Permissions](../../security/AccessToken/app-permissions.md). | 516| callback | Callback<[PermissionStateChangeInfo](js-apis-abilityAccessCtrl.md#permissionstatechangeinfo18)> | Yes| Callback invoked to return the permission state change. | 517 518**Error codes** 519 520For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 521 522| ID| Error Message| 523| -------- | -------- | 524| 201 | Permission denied. Interface caller does not have permission. | 525| 202 | Not System App. Interface caller is not a system app. | 526| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 527| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters. | 528| 12100004 | The API is used repeatedly with the same input. | 529| 12100005 | The registration time has exceeded the limitation. | 530| 12100007 | The service is abnormal. | 531| 12100008 | Out of memory. | 532 533**Example** 534 535```ts 536import { abilityAccessCtrl, Permissions, bundleManager } from '@kit.AbilityKit'; 537 538let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 539let appInfo: bundleManager.ApplicationInfo = bundleManager.getApplicationInfoSync('com.example.myapplication', 0, 100); 540let tokenIDList: Array<number> = [appInfo.accessTokenId]; 541let permissionList: Array<Permissions> = ['ohos.permission.DISTRIBUTED_DATASYNC']; 542try { 543 atManager.on('permissionStateChange', tokenIDList, permissionList, (data: abilityAccessCtrl.PermissionStateChangeInfo) => { 544 console.debug('receive permission state change, data:' + JSON.stringify(data)); 545 }); 546} catch(err) { 547 console.error(`catch err->${JSON.stringify(err)}`); 548} 549``` 550 551### off<sup>9+</sup> 552 553off(type: 'permissionStateChange', tokenIDList: Array<number>, permissionList: Array<Permissions>, callback?: Callback<PermissionStateChangeInfo>): void 554 555Unsubscribes from changes in the state of specified permissions for the given applications. This API uses an asynchronous callback to return the result. 556 557If **callback** is not specified, this API will unregister all callbacks for **tokenIDList** and **permissionList**. 558 559**System API**: This is a system API. 560 561**Required permissions**: ohos.permission.GET_SENSITIVE_PERMISSIONS (available only to system applications) 562 563**System capability**: SystemCapability.Security.AccessToken 564 565**Parameters** 566 567| Name | Type | Mandatory| Description | 568| ------------------ | --------------------- | ---- | ------------------------------------------------------------ | 569| type | string | Yes | Event type. The value is **'permissionStateChange'**, which indicates the permission state changes. | 570| tokenIDList | Array<number> | Yes | List of application token IDs. The value must be the same as that in **on()**. If this parameter is not specified, this API will unsubscribe from the permission state changes of all applications. | 571| permissionList | Array<Permissions> | Yes | List of target permissions. The value must be the same as that in **on()**. If this parameter is not specified, this API will unsubscribe from state changes for all permissions. For details about the permissions, see [Application Permissions](../../security/AccessToken/app-permissions.md).| 572| callback | Callback<[PermissionStateChangeInfo](js-apis-abilityAccessCtrl.md#permissionstatechangeinfo18)> | No| Callback to unregister.| 573 574**Error codes** 575 576For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 577 578| ID| Error Message| 579| -------- | -------- | 580| 201 | Permission denied. Interface caller does not have permission. | 581| 202 | Not System App. Interface caller is not a system app. | 582| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 583| 12100001 | Invalid parameter. The tokenIDs or permissionNames in the list are all invalid. | 584| 12100004 | The API is not used in pair with 'on'. | 585| 12100007 | The service is abnormal. | 586| 12100008 | Out of memory. | 587 588**Example** 589 590```ts 591import { abilityAccessCtrl, Permissions, bundleManager } from '@kit.AbilityKit'; 592 593let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 594let appInfo: bundleManager.ApplicationInfo = bundleManager.getApplicationInfoSync('com.example.myapplication', 0, 100); 595let tokenIDList: Array<number> = [appInfo.accessTokenId]; 596let permissionList: Array<Permissions> = ['ohos.permission.DISTRIBUTED_DATASYNC']; 597try { 598 atManager.off('permissionStateChange', tokenIDList, permissionList); 599} catch(err) { 600 console.error(`catch err->${JSON.stringify(err)}`); 601} 602``` 603 604### requestPermissionOnApplicationSetting<sup>18+</sup> 605 606requestPermissionOnApplicationSetting(tokenID: number): Promise<void> 607 608Starts the permission settings page for an application. This API uses a promise to return the result. 609 610**System API**: This is a system API. 611 612**Model restriction**: This API can be used only in the stage model. 613 614**System capability**: SystemCapability.Security.AccessToken 615 616**Parameters** 617 618| Name | Type | Mandatory| Description | 619| --------- | ------------------- | ---- | ------------------------------------------------------------ | 620| tokenID | number | Yes | Identifier of the target application, which is the value of **accessTokenId** contained in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 621 622**Return value** 623 624| Type | Description | 625| :------------ | :---------------------------------- | 626| Promise<void> | Promise that returns no value.| 627 628**Error codes** 629 630For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 631 632| ID| Error Message| 633| -------- | -------- | 634| 202 | Not System App. Interface caller is not a system app. | 635| 12100002 | The specified tokenID does not exist. | 636| 12100007 | The service is abnormal. | 637 638**Example** 639 640```ts 641import { abilityAccessCtrl } from '@kit.AbilityKit'; 642import { BusinessError } from '@kit.BasicServicesKit'; 643 644let atManager: abilityAccessCtrl.AtManager = abilityAccessCtrl.createAtManager(); 645let tokenID: number = 0; // System applications can obtain the token ID using bundleManager.getApplicationInfo. 646atManager.requestPermissionOnApplicationSetting(tokenID).then(() => { 647 console.log('requestPermissionOnApplicationSetting success'); 648}).catch((err: BusinessError) => { 649 console.error(`requestPermissionOnApplicationSetting fail, err->${JSON.stringify(err)}`); 650}); 651``` 652 653### PermissionRequestToggleStatus<sup>12+</sup> 654 655Enumerates the permission toggle states. 656 657**System capability**: SystemCapability.Security.AccessToken 658 659| Name | Value| Description | 660| ------------------ | ----- | ----------- | 661| CLOSED | 0 | The permission is toggled off. | 662| OPEN | 1 | The permission is toggled on. | 663 664### PermissionStatus<sup>12+</sup> 665 666Enumerates the permission states. 667 668**System API**: This is a system API. 669 670**System capability**: SystemCapability.Security.AccessToken 671 672| Name | Value| Description | 673| ------------------ | ----- | ----------- | 674| DENIED | -1 | The permission is not granted.| 675| GRANTED | 0 | The permission is granted.| 676| NOT_DETERMINED | 1 | The permission state is not determined.| 677| INVALID | 2 | The permission is invalid.| 678| RESTRICTED | 3 | The permission is restricted.| 679