@uipath/skills 1.200.0 → 1.201.0-preview.433

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "uipath",
       "source": "./",
       "description": "UiPath plugin for Claude Code — custom skills, agents, hooks, and MCP servers for UiPath workflows, UI automation, UI testing and UiPath troubleshoot",
-      "version": "1.200.0",
+      "version": "1.201.0",
       "author": {
         "name": "UiPath"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "uipath",
-  "version": "1.200.0",
+  "version": "1.201.0",
   "description": "UiPath plugin for Claude Code — custom skills, agents, hooks, and MCP servers for UiPath RPA workflows, UI automation, UI testing, Python coded agents and UiPath troubleshoot",
   "author": {
     "name": "UiPath"

package/.cursor-plugin/plugin.json

@@ -0,0 +1,32 @@
+{
+  "name": "uipath",
+  "displayName": "UiPath",
+  "version": "1.201.0",
+  "description": "UiPath plugin for Cursor — skills for building, running, testing, and deploying UiPath automations, agents, coded apps, and platform operations.",
+  "author": {
+    "name": "UiPath",
+    "email": "support@uipath.com"
+  },
+  "homepage": "https://github.com/UiPath/skills",
+  "repository": "https://github.com/UiPath/skills",
+  "license": "MIT",
+  "keywords": [
+    "uipath",
+    "automation",
+    "rpa",
+    "workflows",
+    "skills",
+    "code",
+    "xaml",
+    "studio",
+    "ui-automation",
+    "ui-testing",
+    "desktop",
+    "browser",
+    "coded-apps",
+    "coded-agents",
+    "agent",
+    "troubleshoot"
+  ],
+  "logo": "assets/uipath-icon.png"
+}

package/CODEOWNERS

@@ -14,6 +14,14 @@
 # CLI versions config (per-environment CLI versions)
 /assets/cli-versions.json @vlad-uipath
 
+# Studio Web flavor overrides
+/skill-flavors/studioweb/ @astridstaicu
+
+# preview skills
+/preview/uipath-maestro-flow/  @dmetzgar @tmatup
+/preview/uipath-maestro-case/ @dmetzgar @tmatup
+/preview/uipath-maestro-bpmn/ @dmetzgar @tmatup
+
 # Activity references (bundled inside uipath-rpa skill)
 /skills/uipath-rpa/references/activity-docs/ @DragosUnguru
 
@@ -71,8 +79,16 @@
 /tests/tasks/activation/uipath-functions.jsonl @AlexBizon @UiPath/team-coded-agents
 
 # Planner skill (PDD → SDD design + multi-skill task planning)
-/skills/uipath-planner/ @RaduAna-Maria @abhiram-vad
-/tests/tasks/uipath-planner/ @RaduAna-Maria @abhiram-vad
+/skills/uipath-planner/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25
+/tests/tasks/uipath-planner/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25
+# Case-design evals migrated from uipath-maestro-case (planner-sole-SDD-author) — case owners stay reviewers
+/tests/tasks/uipath-planner/_shared/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_design_interview/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_design_loan/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_finalize_draft/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_finalize_draft_loan/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_finalize_draft_picker/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
+/tests/tasks/uipath-planner/case_finalize_draft_reject/ @RaduAna-Maria @abhiram-vad @charlesliu9 @song-zhao-25 @jundayin
 
 # Solution skill (uip solution lifecycle)
 /skills/uipath-solution/ @UiPath/team-merlot @UiPath/team-orange
@@ -100,8 +116,8 @@
 /tests/tasks/uipath-human-in-the-loop/ @dushyant-uipath
 
 # Case Management skill
-/skills/uipath-maestro-case/ @charlesliu9 @song-zhao-25 @abhiram-vad @jundayin
-/tests/tasks/uipath-maestro-case/ @charlesliu9 @song-zhao-25 @abhiram-vad @jundayin
+/skills/uipath-maestro-case/ @charlesliu9 @song-zhao-25 @abhiram-vad @roberts-cliff
+/tests/tasks/uipath-maestro-case/ @charlesliu9 @song-zhao-25 @abhiram-vad @roberts-cliff
 /tests/tasks/uipath-maestro-case/guardrails/ @apetraru-uipath @valentinabojan @ctiliescuuipath
 
 # Coded Apps skill
@@ -117,6 +133,7 @@
 # Add your team here when contributing a new plugin category
 /skills/uipath-maestro-flow/references/plugins/connector/ @baishalighosh @chandusailella @bai-uipath @rockymadden @DevMomo
 /skills/uipath-maestro-flow/references/plugins/connector-trigger/ @baishalighosh @chandusailella @bai-uipath @rockymadden @DevMomo
+/skills/uipath-maestro-flow/references/author/references/plugins/agent/ @UiPath/team-coded-agents @AlexandruCGhimisi @andreibalas-uipath @al3xanndru
 /skills/uipath-maestro-flow/references/author/references/plugins/inline-agent/ @AlexandruCGhimisi @andreibalas-uipath @al3xanndru
 /tests/tasks/uipath-maestro-flow/connector_features/ @baishalighosh @chandusailella @mukundbayyaram
 
@@ -175,3 +192,7 @@
 /skills/uipath-process-mining/ @UiPath/team-backendhoven
 /tests/tasks/uipath-process-mining/ @UiPath/team-backendhoven
 /tests/tasks/activation/uipath-process-mining.jsonl @UiPath/team-backendhoven
+
+# Automation Hub skills (Open API publish/read of processes via the user's cloud token)
+/skills/uipath-automationhub/ @parth-patil-uipath @abhiram-vad
+/tests/tasks/uipath-automationhub/ @parth-patil-uipath @abhiram-vad

package/README.md

@@ -106,6 +106,7 @@ Every skill's maturity is tracked in [`assets/skill-status.json`](assets/skill-s
 | `uipath-agents` | In-development |
 | `uipath-api-workflow` | In-development |
 | `uipath-automation-discovery` | Preview |
+| `uipath-automationhub` | In-development |
 | `uipath-coded-apps` | Preview |
 | `uipath-connector-builder` | In-development |
 | `uipath-feedback` | Stable |

package/assets/skill-status.json

@@ -49,6 +49,14 @@
       },
       "last_synced": null
     },
+    "uipath-automationhub": {
+      "status": "in-development",
+      "confluence": {
+        "page_id": null,
+        "url": null
+      },
+      "last_synced": null
+    },
     "uipath-coded-apps": {
       "status": "preview",
       "confluence": {

package/assets/uip-catalog-snapshot.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-08-08T04:29:32Z",
-  "cli_version": "1.200.0-dev.8173",
+  "generated_at": "2026-08-22T04:19:58Z",
+  "cli_version": "1.201.0-dev.8319",
   "verbs": [
     "admin",
     "admin audit",
@@ -250,6 +250,62 @@
     "agenthub remote-a2a-agent list",
     "agenthub remote-a2a-agent refresh-card",
     "agenthub remote-a2a-agent update",
+    "ah",
+    "ah applications",
+    "ah applications delete",
+    "ah applications list",
+    "ah applications update",
+    "ah audit-logs",
+    "ah audit-logs download",
+    "ah audit-logs list",
+    "ah auth-info",
+    "ah auth-info get",
+    "ah automations",
+    "ah automations create",
+    "ah automations get",
+    "ah automations list",
+    "ah automations schema",
+    "ah automations schema get",
+    "ah automations update",
+    "ah business-cases",
+    "ah business-cases get",
+    "ah business-cases set-baseline",
+    "ah categories",
+    "ah categories get",
+    "ah categories set",
+    "ah categories update",
+    "ah collaborators",
+    "ah collaborators create",
+    "ah collaborators delete",
+    "ah collaborators list",
+    "ah components",
+    "ah components list",
+    "ah documents",
+    "ah documents create",
+    "ah documents download",
+    "ah documents list",
+    "ah idea-flows",
+    "ah idea-flows list",
+    "ah media",
+    "ah media create",
+    "ah phases",
+    "ah phases set",
+    "ah pipelines",
+    "ah pipelines list",
+    "ah questionnaires",
+    "ah questionnaires list",
+    "ah roles",
+    "ah roles list",
+    "ah store-listings",
+    "ah store-listings list",
+    "ah store-reviews",
+    "ah store-reviews list",
+    "ah tags",
+    "ah tags set",
+    "ah users",
+    "ah users create",
+    "ah users list",
+    "ah users update",
     "aops",
     "aops connection",
     "aops connection azure-projects",
@@ -460,8 +516,18 @@
     "guardrails byo-configurations create",
     "guardrails byo-configurations delete",
     "guardrails byo-configurations list",
+    "guardrails byo-configurations list-validators",
+    "guardrails byo-configurations probe",
     "guardrails byo-configurations update",
     "insights",
+    "insights filter-folders",
+    "insights filter-folders list",
+    "insights filter-machines",
+    "insights filter-machines list",
+    "insights filter-processes",
+    "insights filter-processes list",
+    "insights filter-queues",
+    "insights filter-queues list",
     "insights jobs",
     "insights jobs completed-timeline",
     "insights jobs failure-details",
@@ -565,7 +631,10 @@
     "ixp data-types rename",
     "ixp data-types update-instructions",
     "ixp deployments",
+    "ixp deployments create",
     "ixp deployments get-taxonomy",
+    "ixp deployments list",
+    "ixp deployments upgrade",
     "ixp documents",
     "ixp documents delete",
     "ixp documents download",
@@ -622,6 +691,8 @@
     "logout",
     "maestro",
     "maestro bpmn",
+    "maestro bpmn check",
+    "maestro bpmn compile",
     "maestro bpmn debug",
     "maestro bpmn debug-instance",
     "maestro bpmn debug-instance breakpoints",
@@ -633,6 +704,7 @@
     "maestro bpmn debug-instance variables",
     "maestro bpmn debug-instance variables-all",
     "maestro bpmn debug-instance variables-set",
+    "maestro bpmn format",
     "maestro bpmn incident",
     "maestro bpmn incident get",
     "maestro bpmn incident summary",
@@ -679,28 +751,26 @@
     "maestro bpmn processes error-codes",
     "maestro bpmn processes incidents",
     "maestro bpmn processes list",
+    "maestro bpmn refresh",
     "maestro bpmn registry",
     "maestro bpmn registry get",
     "maestro bpmn registry list",
     "maestro bpmn registry pull",
     "maestro bpmn registry search",
+    "maestro bpmn tidy",
+    "maestro bpmn update-metadata",
     "maestro bpmn validate",
     "maestro case",
     "maestro case case-exit-conditions",
-    "maestro case case-exit-conditions add",
     "maestro case case-exit-conditions get",
-    "maestro case case-exit-conditions remove",
-    "maestro case case-exit-conditions update",
     "maestro case cases",
-    "maestro case cases add",
     "maestro case cases get",
-    "maestro case cases update",
+    "maestro case check",
+    "maestro case compile",
     "maestro case debug",
+    "maestro case decompile",
     "maestro case edges",
-    "maestro case edges add",
     "maestro case edges get",
-    "maestro case edges remove",
-    "maestro case edges update",
     "maestro case incident",
     "maestro case incident get",
     "maestro case incident summary",
@@ -755,62 +825,33 @@
     "maestro case registry search",
     "maestro case sla",
     "maestro case sla escalation",
-    "maestro case sla escalation add",
     "maestro case sla escalation list",
-    "maestro case sla escalation remove",
     "maestro case sla get",
-    "maestro case sla remove",
     "maestro case sla rules",
-    "maestro case sla rules add",
     "maestro case sla rules list",
-    "maestro case sla rules remove",
-    "maestro case sla set",
     "maestro case spec",
     "maestro case stage-entry-conditions",
-    "maestro case stage-entry-conditions add",
     "maestro case stage-entry-conditions get",
-    "maestro case stage-entry-conditions remove",
-    "maestro case stage-entry-conditions update",
     "maestro case stage-exit-conditions",
-    "maestro case stage-exit-conditions add",
     "maestro case stage-exit-conditions get",
-    "maestro case stage-exit-conditions remove",
-    "maestro case stage-exit-conditions update",
     "maestro case stages",
-    "maestro case stages add",
     "maestro case stages get",
-    "maestro case stages remove",
-    "maestro case stages update",
     "maestro case sticky-notes",
-    "maestro case sticky-notes add",
     "maestro case sticky-notes get",
-    "maestro case sticky-notes remove",
-    "maestro case sticky-notes update",
     "maestro case task-entry-conditions",
-    "maestro case task-entry-conditions add",
     "maestro case task-entry-conditions get",
-    "maestro case task-entry-conditions remove",
-    "maestro case task-entry-conditions update",
     "maestro case tasks",
-    "maestro case tasks add",
-    "maestro case tasks add-connector",
     "maestro case tasks describe",
     "maestro case tasks enrich",
     "maestro case tasks get",
-    "maestro case tasks remove",
-    "maestro case tasks update",
-    "maestro case triggers",
-    "maestro case triggers add-event",
-    "maestro case triggers add-manual",
-    "maestro case triggers add-timer",
     "maestro case validate",
-    "maestro case var",
-    "maestro case var bind",
     "maestro flow",
     "maestro flow binding",
     "maestro flow binding add",
     "maestro flow binding list",
     "maestro flow binding remove",
+    "maestro flow check",
+    "maestro flow compile",
     "maestro flow debug",
     "maestro flow debug-instance",
     "maestro flow debug-instance breakpoints",
@@ -822,6 +863,7 @@
     "maestro flow debug-instance variables",
     "maestro flow debug-instance variables-all",
     "maestro flow debug-instance variables-set",
+    "maestro flow decompile",
     "maestro flow edge",
     "maestro flow edge add",
     "maestro flow edge delete",
@@ -882,6 +924,7 @@
     "maestro flow job list",
     "maestro flow job status",
     "maestro flow job traces",
+    "maestro flow merge",
     "maestro flow migrate",
     "maestro flow node",
     "maestro flow node add",
@@ -920,6 +963,10 @@
     "maestro flow variable-update add",
     "maestro flow variable-update list",
     "maestro flow variable-update remove",
+    "maestro registry",
+    "maestro registry path",
+    "maestro registry pull",
+    "maestro registry search",
     "mcp",
     "mcp serve",
     "model-hub",
@@ -1148,6 +1195,7 @@
     "pm app-types get",
     "pm app-types list",
     "pm apps",
+    "pm apps changes",
     "pm apps create",
     "pm apps data-mapping",
     "pm apps data-mapping get",
@@ -1156,18 +1204,27 @@
     "pm apps data-model add-table",
     "pm apps data-model get",
     "pm apps delete",
+    "pm apps get",
     "pm apps list",
     "pm apps model",
+    "pm apps model dashboards",
+    "pm apps model dashboards get",
+    "pm apps model dashboards list",
+    "pm apps model dashboards update",
     "pm apps model fields",
     "pm apps model fields list",
     "pm apps model fields remove",
     "pm apps model fields set",
     "pm apps model get",
+    "pm apps model metrics",
+    "pm apps model metrics list",
     "pm apps model update",
+    "pm apps publications",
     "pm apps publish",
     "pm files",
     "pm files upload",
     "pm ingestions",
+    "pm ingestions cancel",
     "pm ingestions create",
     "pm ingestions logs",
     "pm query",
@@ -1180,6 +1237,7 @@
     "pm query run",
     "pm transformations",
     "pm transformations apply",
+    "pm transformations cancel",
     "pm transformations create",
     "pm transformations get",
     "pm transformations list",
@@ -1288,6 +1346,7 @@
     "solution feeds",
     "solution feeds list",
     "solution init",
+    "solution list",
     "solution pack",
     "solution packages",
     "solution packages delete",
@@ -1312,9 +1371,22 @@
     "solution upload",
     "tasks",
     "tasks assign",
+    "tasks catalogs",
+    "tasks catalogs create",
+    "tasks catalogs get",
+    "tasks catalogs list",
+    "tasks catalogs update",
+    "tasks comments",
+    "tasks comments add",
+    "tasks comments list",
     "tasks complete",
+    "tasks data",
+    "tasks data get",
+    "tasks data save",
     "tasks get",
+    "tasks labels",
     "tasks list",
+    "tasks metadata",
     "tasks reassign",
     "tasks unassign",
     "tasks users",

package/commands/install-permissions.md

@@ -1,4 +1,5 @@
 ---
+name: install-permissions
 description: Install a curated Claude Code allowlist for safe `uip` subcommands so the agent is not prompted on every command.
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uipath/skills",
-  "version": "1.200.0",
+  "version": "1.201.0-preview.433",
   "description": "UiPath agent skills for Claude Code, Codex, Cursor, Copilot, Gemini and OpenCode — RPA, UI automation, UI testing, coded agents/apps/workflows, and troubleshooting. Distributed as the UiPath Claude Code plugin.",
   "author": {
     "name": "UiPath"
@@ -33,6 +33,7 @@
     "hooks",
     "assets",
     ".claude-plugin",
+    ".cursor-plugin",
     "version-manifest.json",
     "README.md",
     "LICENSE",
@@ -40,7 +41,7 @@
     "scripts/npm-package-lifecycle.mjs"
   ],
   "scripts": {
-    "skills:test": "node --test tests/scripts/compose-skill-flavor.test.mjs tests/scripts/manage-skill-flavors-skill.test.mjs",
+    "skills:test": "node --test tests/scripts/compose-skill-flavor.test.mjs tests/scripts/manage-skill-flavors-skill.test.mjs tests/scripts/sync-maestro-sdk-preview.test.mjs",
     "skills:validate": "node scripts/compose-skill-flavor.mjs validate",
     "skills:build": "node scripts/compose-skill-flavor.mjs build",
     "skills:pack": "node scripts/compose-skill-flavor.mjs pack",

package/skills/uipath-admin/SKILL.md

@@ -102,7 +102,7 @@ Each rule is the agent contract. Per-area detail is in the linked reference file
 
 11. **Built-in roles are read-only.** Only `Custom` roles can be created / updated / deleted. CLI also rejects authoring against service-managed and platform-level services. Service lists: [role-management.md → Services That Manage Their Own Roles](references/authorization/role-management.md#services-that-manage-their-own-roles).
 12. **`roles create` / `roles update` are PUT-style upserts.** Body is assembled from inline flags + `--file ./actions.json`. Always `roles get` first before updating — omitted flags overwrite that field.
-13. **`--service` infers scope** (e.g., `--service studio` → `Tenant`; `--service apps` → `Organization`). Combine with `--scope` only to override.
+13. **`--service` infers scope** (e.g., `--service studio` → `Tenant`; `--service apps` → `Organization`). Combine with `--scope` only to override. **Never guess a `serviceName`** — the valid values and the command that re-derives them: [permission-catalog.md → `--service` serviceNames](references/authorization/permission-catalog.md#--service-servicenames-and-how-to-re-derive-them).
 14. **Listing works for every service; authoring is what's blocked.** `roles list --service <svc>` and `roles assignments list --service <svc>` accept every service. For effective access on a principal use `check-access` (PDP).
 15. **Scope vocab differs across verbs.** `roles create --scope`: `Organization|TenantGlobal|Tenant|Project`. `roles assignments create --scope`: those + `Folder|App`. `roles assignments list --scope`: excludes `TenantGlobal`. `check-access --scope`: only `Tenant|Folder`.
 16. **`roles assignments create/delete` MUST resolve the principal first** per Rule 5 — `--identity-id` is a raw UUID the CLI does not name-check.

package/skills/uipath-admin/references/authorization/permission-catalog.md

@@ -40,9 +40,69 @@ uip admin authorization permissions list --service studio --output json
 uip admin authorization permissions list --service documentunderstanding --scope Project --output json
 ```
 
+### `--service` serviceNames and How to Re-Derive Them
+
+`--service <NAME>` is right when the caller names the service ("which permissions does Orchestrator contribute?"). It is wrong for locating a permission whose owning service you do not know — use [Find the Permission Governing an Action](#workflow-find-the-permission-governing-an-action) instead.
+
+The value `--service` takes is a **`serviceName`** — the API filter this flag sets, equal to the catalog `Namespace` lowercased and to `lowercase(OwnerServiceName)` from `roles list`. All 22 (verified against `uip` 1.201.0):
+
+```
+apps  audit  authz  automationops  casemanagement  communicationsmining  cx
+dataservice  documentunderstanding  governedinference  identity  insights
+licensing  oms  orchestrator  platform  processmining  reinfer  relay  studio
+taskmining  testmanager
+```
+
+`centralizedaccess` is the one namespace with **no** usable `serviceName`. `CENTRALIZEDACCESS` permissions (the platform Administration page) are reachable only via `--scope Tenant` or an unfiltered list.
+
+Derive the `serviceName` from `Namespace` or `OwnerServiceName`, never from `ServiceDisplayName`: `reinfer` works and `ixp` does not (`REINFER` / `Reinfer` displays as "IXP"); `casemanagement` works and `maestro` does not (displays as "Maestro").
+
+#### Re-derive the List When a `serviceName` Is Rejected
+
+Never guess a replacement `serviceName`, and never trust the `Known services:` roster printed by `check-access --help` — it is a stale 18-entry mirror that omits `audit`, `communicationsmining`, `cx`, `governedinference`, and `relay`. Ask the catalog:
+
+```bash
+uip admin authorization permissions list --output plain --output-filter "[].Namespace" \
+  | tr '[:upper:]' '[:lower:]' | sort -u | grep -v '^centralizedaccess$'
+```
+
+`--output plain` emits one bare value per line, so this needs no `jq` and the ~210 KB catalog never reaches the transcript. Run it, pick the real `serviceName`, retry the original command.
+
 ## Cross-Cutting `authz` Permissions
 
-`authz` permissions appear alongside every service's permissions and are filtered out of `permissions list` by default. Pass `--service authz` to surface them.
+`AUTHZ` holds 14 permissions: 10 at `ScopeType: ANY` — the only `ANY` rows in the whole catalog — plus 4 at `ORGANIZATION`. `ANY` matches every scope filter, so **every** `--service` slice returns those 10 alongside the service's own rows: `--service studio` yields `STUDIO` + `AUTHZ`, `--service identity` yields `IDENTITY` + `AUTHZ`. `--service authz` adds the 4 `ORGANIZATION` rows.
+
+A slice is a **role-shape slice**, never a namespace filter, and never returns another namespace's rows. Two consequences:
+
+1. **A slice returning only those 10 `AUTHZ` rows means the `--service` / `--scope` pair matched nothing of that service** — e.g. `--service apps --scope Project`. That floor, not `Data: []`, is the "wrong slice" signal.
+2. **A valid `serviceName` at the wrong scope hides real permissions.** `--service documentunderstanding` returns 17 rows at its inferred `Tenant` scope; `--scope Project` returns 49. Never rule a permission out from one slice — drop `--service` and re-query.
+
+## Workflow: Find the Permission Governing an Action
+
+Use this when diagnosing a 403 or mapping a UI surface ("the Administration page", "the Studio settings tab") to its permission name. Search the **whole** catalog — do not pre-filter by `--service`:
+
+```bash
+uip admin authorization permissions list --output json \
+  --output-filter "[?contains(Name, 'ADMINISTRATION')]"
+```
+
+```json
+{ "Name": "CENTRALIZEDACCESS.ADMINISTRATIONPAGE.VIEW", "Namespace": "CENTRALIZEDACCESS",
+  "ResourceType": "AdministrationPage", "ResourceAction": "View",
+  "Description": "View the administration page", "ScopeType": "TENANT" }
+```
+
+Rules:
+
+1. **When searching, always filter.** An unfiltered list is ~500 records / ~210 KB of JSON — past most agents' tool-output limit, so it truncates and the record you need can be present but unread. Never conclude "not found" from a truncated list. (Filtering is for *finding* one permission. When the goal is to hand over the whole catalog, or one named service's slice, list it unfiltered or with `--service` and save it complete — see [Find Permission Names for Role Authoring](#workflow-find-permission-names-for-role-authoring).)
+2. **`--output-filter` JMESPath `contains` is case-sensitive.** `Name` is UPPERCASE; `Description`, `ResourceType`, and `ResourceGroup` are sentence/Pascal case. `contains(Description, 'Administration')` returns `[]` while `contains(Description, 'administration')` matches.
+3. Search `Name` on an UPPERCASE keyword first, then widen to `Description` in lowercase:
+   ```bash
+   uip admin authorization permissions list --output json \
+     --output-filter "[?contains(Name, 'ADMIN') || contains(Description, 'admin')]"
+   ```
+4. Narrow by role shape with `--scope`, never a guessed `--service`. Scope matters: `--scope Tenant` surfaces the Administration page permission, `--scope Organization` does not — so try the unfiltered catalog before ruling a permission out.
+5. Read `ScopeType` off the hit — it dictates the role scope needed to grant it (`TENANT` → a `Tenant`- or `TenantGlobal`-shape role). See [role-management.md](role-management.md).
 
 ## Workflow: Find Permission Names for Role Authoring
 

package/skills/uipath-admin/references/authorization/role-management.md

@@ -24,7 +24,7 @@ For *effective* access on a principal (PDP — includes server-side rules not vi
 
 **`Folder` is not a valid `--scope` for `roles create/update`.** Folder-level scoping is expressed on the *assignment* (see [role-assignment-management.md](role-assignment-management.md)).
 
-> `--service` infers the scope from the service registry when `--scope` is omitted. Example: `roles create --service studio --name "..."` resolves to `Tenant`. Combine `--service` with `--scope` only to override the registry default (e.g., `--service documentunderstanding --scope Project`).
+> `--service` infers the scope from the service registry when `--scope` is omitted. Example: `roles create --service studio --name "..."` resolves to `Tenant`. Combine `--service` with `--scope` only to override the registry default (e.g., `--service documentunderstanding --scope Project`). **Unsure which `serviceName` to pass, or the CLI rejected the one you tried?** Never guess — the valid values and the command that re-derives them live in [permission-catalog.md — `--service` serviceNames](permission-catalog.md#--service-servicenames-and-how-to-re-derive-them).
 
 ### Centralized Access — the "no --service" tenant role
 
@@ -64,6 +64,8 @@ If the role wraps **one** service's permissions, do not ask the user about org v
 uip admin authorization permissions list --service <SERVICE> --output json
 ```
 
+`<SERVICE>` must be a real `serviceName` — look it up in [permission-catalog.md — `--service` serviceNames](permission-catalog.md#--service-servicenames-and-how-to-re-derive-them) rather than guessing from the service's display name.
+
 The catalog response includes `scopeType` per record. Use it to pick the mode for Step 4:
 
 | Records' `scopeType` | Service shape | Use this for the rest of the flow |

package/skills/uipath-admin/references/diagnose/references/failure-modes.md

@@ -137,10 +137,35 @@ Named failure patterns with symptom → cause → investigation → fix. Match t
 4. Assignment at wrong tenant
 
 **Investigation:**
-1. Verify assignment exists: `uip admin authorization roles assignments list --filter "<PRINCIPAL_NAME>" --output json`
-2. Inspect role: `uip admin authorization roles get "<ROLE_ID>" --output json` — check `ownerServiceName` and `scopeType`
-3. Validate Rule 17: `CentralizedAccess` → no service segment in scope-path; any other value → path must include `lowercase(ownerServiceName)`
-4. Verify via PDP: `uip admin authorization check-access "<PRINCIPAL_ID>" --output json`
+1. Inspect the role first: `uip admin authorization roles get "<ROLE_ID>" --output json` — check `ownerServiceName` and `scopeType`
+2. Validate Rule 17: `CentralizedAccess` → no service segment in scope-path; any other value → path must include `lowercase(ownerServiceName)`
+3. Verify via PDP: `uip admin authorization check-access "<PRINCIPAL_ID>" --output json`
+4. List the principal's grants: `uip admin authorization roles assignments list --identity-id "<PRINCIPAL_ID>" --output json` (`--filter` is **not** a valid flag here — it exists on `roles list`, not on `assignments list`)
+
+> **A mis-scoped grant is invisible to the default listing — use `--scope-path` to see it.**
+> `assignments list` filters on a scope path **and** a service, both derived from your flags:
+>
+> | flags | server scope | server serviceName |
+> |---|---|---|
+> | none, `--identity-id`, `--scope Tenant` | `/tenant/<tid>` | `centralizedaccess` |
+> | `--service <svc>` | `/tenant/<tid>/<svc>` | `<svc>` |
+> | `--scope-path <path>` (no `--service`) | `<path>` verbatim | **unset** |
+>
+> A Cause 1 grant — a `<svc>`-owned role granted at the bare `/tenant/<tid>` — matches
+> neither of the first two shapes: the centralized-access shapes exclude it on service,
+> and the `--service` shape excludes it on path. So it is absent from the default
+> listing, from `--identity-id`, from `--scope Tenant` (with or without
+> `--include-inherited`) and from `--service <svc>`. Retrieve it with the one shape that
+> applies no service filter:
+>
+> ```bash
+> uip admin authorization roles assignments list --scope-path "/tenant/<TENANT_ID>" --output json
+> ```
+>
+> Verified on a live tenant: this returns the mis-scoped grant while every other shape
+> returns only the principal's other grants. **Never read an empty centralized-access
+> listing as "the grant does not exist"** — re-query with `--scope-path` first, and never
+> re-create the assignment on that basis, which reproduces the original mismatch.
 
 **Fix:** Cause 1 → re-create assignment with correct scope-path matching ownerServiceName. Cause 2 → re-assign at correct scope. Cause 3 → update role actions. Cause 4 → re-assign at correct tenant.
 

package/skills/uipath-admin/references/diagnose/references/troubleshooting-guide.md

@@ -58,6 +58,19 @@ Interpret the results:
 
 See [check-access.md](../../authorization/check-access.md) for full interpretation guide.
 
+### Step 3b: Identify the Permission the Denied Action Requires
+
+The PDP says what the principal *has*; it never says what the action *needs*. Look the required permission up in the catalog before naming a fix — searching the whole catalog, not a guessed `--service` slice:
+
+```bash
+uip admin authorization permissions list --output json \
+  --output-filter "[?contains(Name, 'ADMINISTRATION')]"
+```
+
+`contains` is case-sensitive: `Name` is UPPERCASE, `Description` is lowercase. A guessed `--service` returns `Data: []` and an unfiltered list is ~210 KB that truncates — neither empty result proves the permission is absent. See [permission-catalog.md — Find the Permission Governing an Action](../../authorization/permission-catalog.md#workflow-find-the-permission-governing-an-action).
+
+State the diagnosis as: *principal holds `<roles>`, none of which carry `<PERMISSION.NAME>` (`ScopeType` `<SCOPE>`) → grant a `<SCOPE>`-shape role carrying it.* Never substitute a permission you did not find in the catalog.
+
 ## Step 4: Check Audit History
 
 For historical investigation (login failures, "who changed X", "when did access break"):