Permissions
Give each access token the permissions it needs, and nothing more.
Permission areas
Each token sets every area to Disabled, Read or Read-write. Give a token only the permissions it needs.
| Area | Values | Covers |
|---|---|---|
| Clients | Disabled, Read, Read-write | Clients and client notes |
| Staff | Disabled, Read, Read-write | Staff and staff leave |
| Roster | Disabled, Read, Read-write | Shifts, appointments, sites, services and roster metrics |
| Forms | Disabled, Read, Read-write | Forms and submissions |
| Reports | Disabled, Read, Read-write | Report insights, dashboards and spaces |
| Tasks | Disabled, Read, Read-write | Tasks, their charges and notes |
| Incidents | Disabled, Read, Read-write | Incidents and site incidents |
| Prospects | Disabled, Read, Read-write | Prospects |
| Finance | Disabled, Read, Read-write | Charge metrics, and converting a shift's billables |
Clients, Roster and Staff must be set on every token.
What each level allows
Allows nothing for that area. Requests return 403.
Allows safe requests, such as listing and viewing.
Allows those and also changes, such as creating, updating, cancelling and deleting.
Roster covers sites. Site endpoints need Roster Read-write.
Endpoints that need more than one area
| Endpoint | Needs |
|---|---|
POST /clients/{id}/notes | Clients Read, and Read-write on Clients, Tasks or Roster |
PATCH /client-notes/{ref} | Clients Read, and Read-write on Clients or Tasks |
POST /prospects/{id}/convert | Read-write on Prospects and Clients |
POST /shifts/{ref}/billables | Read-write on Finance and Clients |
Which area an endpoint group needs
Was this page helpful?