Permissions & Scopes

Roles

Every organization member has one role, which sets the ceiling on what any token they issue can do:

• Owner
• Admin
• Accountant
• Sales
• Purchase
• Viewer

Scopes

A token is also granted scopes, which narrow (never widen) what it can do:

• Group scopes: read, write, full
• Module scopes (all actions on one module), e.g. customers, quotes, salesOrders, …
• Granular scopes: module.action, e.g. invoices.create

Fetch the live, always-current catalog: GET /api/v1/scopes (no authentication required).

Effective access

A request succeeds only when both the token's scopes grant the permission and the member's role allows it.