Permissions

AdminUpdated Sep 11, 2026

Backend API — secret key (Authorization: Bearer sk_…).

4 routes. Each row is one endpoint with its explanation, required scope, and whether it honours the Idempotency-Key header.

Method & path	Scope	Explanation
`GET /v1/permissions`	`organizations:read`	List permissions available to roles on this instance.
`POST /v1/permissions`	`organizations:write`	Define a custom permission. Keys look like org:invoices:manage.
`PATCH /v1/permissions/:id`	`organizations:write`	Update a permission’s description or metadata.
`DELETE /v1/permissions/:id`	`organizations:write`	Delete a permission; it is removed from every role that held it.

Was this page helpful?