From 6389f81651e4569ad57ab3f82738bc3c01c924a4 Mon Sep 17 00:00:00 2001
From: genwhittTTD <gen.whitt@thetradedesk.com>
Date: Wed, 22 Nov 2023 12:01:09 -0500
Subject: [PATCH] new permissions article

---
 docs/getting-started/gs-credentials.md        |  2 --
 docs/getting-started/gs-permissions.md        | 23 +++++++++++++++++++
 docs/getting-started/gs-roles-permissions.md  | 23 -------------------
 .../current/getting-started/gs-permissions.md | 23 +++++++++++++++++++
 sidebars.js                                   |  2 +-
 5 files changed, 47 insertions(+), 26 deletions(-)
 create mode 100644 docs/getting-started/gs-permissions.md
 delete mode 100644 docs/getting-started/gs-roles-permissions.md
 create mode 100644 i18n/ja/docusaurus-plugin-content-docs/current/getting-started/gs-permissions.md

diff --git a/docs/getting-started/gs-credentials.md b/docs/getting-started/gs-credentials.md
index 10ef6678e..dd5d37438 100644
--- a/docs/getting-started/gs-credentials.md
+++ b/docs/getting-started/gs-credentials.md
@@ -14,8 +14,6 @@ Each UID2 <a href="/docs/intro#participants">participant</a> gets a set of uniqu
 | Participants using a server-side endpoint  | Both of the following:<ul><li>[API key](../ref-info/glossary-uid.md#gl-api-key), also called a client key</li><li>[Client secret](../ref-info/glossary-uid.md#gl-client-secret), a value known only to the participant and the UID2 service</li></ul> | Any integration using one of these endpoints: <ul><li>[POST /identity/map](../endpoints/post-identity-map.md)</li><li>[POST /identity/buckets](../endpoints/post-identity-buckets.md)</li><li>[POST /token/generate](../endpoints/post-token-generate.md)</li></ul> |
 | Participants using a client-side implementation  | Both of the following: <ul><li>Subscription ID</li><li>Public key</li></ul> | Integrations using one of these: <ul><li>[Prebid.js Express Integration Guide](../guides/integration-prebid.md)</li><li>[JavaScript Express Integration Guide](../guides/publisher-client-side.md)</li></ul> |
 
-
-
 If you're using the integration environment as well as the production environment, you'll get a separate set of credentials for each environment.
 
 <!-- It includes:
diff --git a/docs/getting-started/gs-permissions.md b/docs/getting-started/gs-permissions.md
new file mode 100644
index 000000000..4ca5268a8
--- /dev/null
+++ b/docs/getting-started/gs-permissions.md
@@ -0,0 +1,23 @@
+---
+title: API Permissions
+description: Information about UID2 API permissions
+hide_table_of_contents: false
+sidebar_position: 07
+---
+
+# API Permissions
+
+The UID2 ecosystem includes several different API permissions that allow access to complete specific activities. This approach is part of the overall secure design of UID2.
+
+For each UID2 participant, the permissions are linked to the participant's API credentials (see [Account Setup](gs-account-setup.md) and [UID2 Credentials](gs-credentials.md)).
+
+A participant can have one or several sets of API credentials with associated permissions. In cases where you have more than one API permission, you have the option to have a separate set of credentials for each permission or have a single set of credentials for all permissions. We recommend having a separate set of credentials for each permission. 
+
+The following table lists the key permissions, the types of participants that commonly use them, and a summary of the key associated activities.
+
+| Name | Participant Type | Permissions |
+| :--- | :--- | :--- |
+| Generator | Publishers | Permission to call the [POST /token/generate](../endpoints/post-token-generate.md), [POST /token/validate](../endpoints/post-token-validate.md), and [POST /token/refresh](../endpoints/post-token-refresh.md) endpoints, to generate UID2 tokens from DII and to refresh them, using one of these integration methods:<ul><li>A Prebid integration</li><li>The UID2 SDK for JavaScript</li><li>An integration that directly calls the applicable API endpoints for retrieving and managing UID2 tokens.</li></ul> |
+| Bidder | DSPs | Permission to decrypt UID2 tokens coming in from the bid stream from publishers into raw UID2s for bidding purposes. |
+| Sharer | Any participant type that takes part in UID2 sharing. For details, see [UID2 Sharing: Overview](../sharing/sharing-overview.md). | Permission to do both of the following:<ul><li>Encrypt raw UID2s into UID2 tokens for sharing with another authorized sharing participant, using a UID2 SDK or Snowflake</li><li>Decrypt UID2 tokens received from another authorized sharing participant into raw UID2s.</li></ul> |
+| Mapper | Advertisers<br/>Data Providers | Permission to use the [POST /identity/buckets](../endpoints/post-identity-buckets.md) endpoint to monitor rotated salt buckets and to use the [POST /identity/map](../endpoints/post-identity-map.md) endpoint to map multiple email addresses, phone numbers, or their respective hashes to their raw UID2s and salt bucket IDs. |
diff --git a/docs/getting-started/gs-roles-permissions.md b/docs/getting-started/gs-roles-permissions.md
deleted file mode 100644
index 5403650cd..000000000
--- a/docs/getting-started/gs-roles-permissions.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: API Roles and Permissions
-description: Information about UID2 API roles and associated permissions
-hide_table_of_contents: false
-sidebar_position: 07
----
-
-# API Roles and Permissions
-
-The UID2 ecosystem includes several different API roles. A UID2 participant with a specific role has associated permissions that allow access to complete all necessary activities. This approach is part of the overall secure design of UID2.
-
-For each UID2 participant, the role and associated permissions are linked to the participant's API credentials (see [Account Setup](gs-account-setup.md)).
-
-A participant can have one or several sets of API credentials with associated roles. In cases where you have more than one API role, you have the option to have a separate set of credentials for each role or have a single set of credentials for all roles. We recommend having a separate set of credentials for each role. 
-
-The following table lists the key roles, the types of participants that commonly have those roles, and a summary of the key associated permissions.
-
-| Role | Participant Type | Permissions |
-| :--- | :--- | :--- |
-| Generator | Publishers | Permission to generate UID2 tokens from DII and to refresh them, either via a Prebid implementation, by using the JavaScript SDK, or by an implementation that directly calls the applicable API endpoints for retrieving and managing UID2 tokens. |
-| ID reader {**GWH_AT suggests Bidder**} | DSPs | Permission to decrypt UID2 tokens to raw UID2s. (**GWH_AT he says: Need to briefly describe how ID reader is different from sharer.**) |
-| Sharer | Any participant type that takes part in UID2 sharing. For details, see [UID2 Sharing: Overview](../sharing/sharing-overview.md). | Permission to encrypt raw UID2s into UID2 tokens for sharing with another authorized sharing participant, using a UID2 SDK or Snowflake, and permission to decrypt UID2 tokens received from another authorized sharing participant into raw UID2s. |
-| Mapper | Advertisers<br/>Data Providers | Permission to use the [POST /identity/buckets](../endpoints/post-identity-buckets.md) endpoint to monitor rotated salt buckets and to use the [POST /identity/map](../endpoints/post-identity-map.md) endpoint to map multiple email addresses, phone numbers, or their respective hashes to their raw UID2s and salt bucket IDs. |
diff --git a/i18n/ja/docusaurus-plugin-content-docs/current/getting-started/gs-permissions.md b/i18n/ja/docusaurus-plugin-content-docs/current/getting-started/gs-permissions.md
new file mode 100644
index 000000000..4ca5268a8
--- /dev/null
+++ b/i18n/ja/docusaurus-plugin-content-docs/current/getting-started/gs-permissions.md
@@ -0,0 +1,23 @@
+---
+title: API Permissions
+description: Information about UID2 API permissions
+hide_table_of_contents: false
+sidebar_position: 07
+---
+
+# API Permissions
+
+The UID2 ecosystem includes several different API permissions that allow access to complete specific activities. This approach is part of the overall secure design of UID2.
+
+For each UID2 participant, the permissions are linked to the participant's API credentials (see [Account Setup](gs-account-setup.md) and [UID2 Credentials](gs-credentials.md)).
+
+A participant can have one or several sets of API credentials with associated permissions. In cases where you have more than one API permission, you have the option to have a separate set of credentials for each permission or have a single set of credentials for all permissions. We recommend having a separate set of credentials for each permission. 
+
+The following table lists the key permissions, the types of participants that commonly use them, and a summary of the key associated activities.
+
+| Name | Participant Type | Permissions |
+| :--- | :--- | :--- |
+| Generator | Publishers | Permission to call the [POST /token/generate](../endpoints/post-token-generate.md), [POST /token/validate](../endpoints/post-token-validate.md), and [POST /token/refresh](../endpoints/post-token-refresh.md) endpoints, to generate UID2 tokens from DII and to refresh them, using one of these integration methods:<ul><li>A Prebid integration</li><li>The UID2 SDK for JavaScript</li><li>An integration that directly calls the applicable API endpoints for retrieving and managing UID2 tokens.</li></ul> |
+| Bidder | DSPs | Permission to decrypt UID2 tokens coming in from the bid stream from publishers into raw UID2s for bidding purposes. |
+| Sharer | Any participant type that takes part in UID2 sharing. For details, see [UID2 Sharing: Overview](../sharing/sharing-overview.md). | Permission to do both of the following:<ul><li>Encrypt raw UID2s into UID2 tokens for sharing with another authorized sharing participant, using a UID2 SDK or Snowflake</li><li>Decrypt UID2 tokens received from another authorized sharing participant into raw UID2s.</li></ul> |
+| Mapper | Advertisers<br/>Data Providers | Permission to use the [POST /identity/buckets](../endpoints/post-identity-buckets.md) endpoint to monitor rotated salt buckets and to use the [POST /identity/map](../endpoints/post-identity-map.md) endpoint to map multiple email addresses, phone numbers, or their respective hashes to their raw UID2s and salt bucket IDs. |
diff --git a/sidebars.js b/sidebars.js
index c35e968db..3dbf1f968 100644
--- a/sidebars.js
+++ b/sidebars.js
@@ -28,7 +28,7 @@ const sidebars = {
       items: [
         'getting-started/gs-account-setup',
         'getting-started/gs-credentials',
-        'getting-started/gs-roles-permissions',
+        'getting-started/gs-permissions',
         'getting-started/gs-auth',
         'getting-started/gs-environments',
         'getting-started/gs-api-using',