Skip to content
You are reading Hyperledger Besu development version documentation and some displayed features may not be available in the stable release. You can switch to stable version using the version box at screen bottom.
Last update: December 13, 2021

Permissioning plugin

You can define complex permissioning solutions by building a plugin that extends Hyperledger Besu functionality.

The plugin API provides a PermissioningService interface that currently supports connection permissioning and message permissioning.

Connection permissioning

Use connection permissioning when deciding whether to restrict node access to known participants only.

Message permissioning

Use message permissioning to propagate different types of devP2P messages to particular nodes. For example, this can be used to prevent pending transactions from being forwarded to other nodes.

Registering your plugin

To enable permissioning in your plugin, implement the PermissioningService interface and register your providers.

public class TestPermissioningPlugin implements BesuPlugin {
    PermissioningService service;

    public void register(final BesuContext context) {
        service = context.getService(PermissioningService.class).get();

    public void start() {
        service.registerNodePermissioningProvider((sourceEnode, destinationEnode) -> {
            // perform logic for node permissioning
            return true;

        service.registerNodeMessagePermissioningProvider((destinationEnode, code) -> {
            // perform logic for message permissioning
            return true;

    public void stop() {}
Questions or feedback? You can discuss issues and obtain free support on Hyperledger Besu chat channel.
For Hyperledger Besu community support, contact the mailing list