Create an access role
The API runs on your application instance. Schemas and field names come directly from the OpenAPI specification. Session-authenticated requests require a session on that instance.
Requires an authenticated browser session with the roles.manage permission. Role keys are stable identifiers used by users and conditional rules.
adminSessionauthjs.session-token<token>Authenticated Auth.js browser session cookie; each operation declares its required permission. Not restricted to administrators. HTTPS deployments use the secure-prefixed cookie variant.
X-Organization-ID?stringOrganization membership selected for this request. User-bound credentials may select any active membership; standalone tokens may only repeat their pinned organization ID.
uuidapplication/json- body
key*AccessRoleKeyStable lowercase identifier for a built-in or custom role.
^[a-z][a-z0-9_-]{0,63}$1 <= length <= 64name*string1 <= length <= 120description?stringlength <= 1000""permissions?array<>items <= 30[]Role created
application/json- response
role*curl -X POST 'https://example.com/api/access/roles' \ -H 'Content-Type: application/json' \ -d '{ "key": "editor", "name": "string"}'{ "role": { "key": "editor", "name": "string", "description": "string", "permissions": [ "inventory.read" ], "isSystem": true, "memberCount": 0, "createdBy": "string", "updatedBy": "string", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z" }}List roles, inventory access rules, and permission metadata GET
Requires an authenticated browser session with the roles.manage permission. Rules grant additional item-specific permissions when every condition matches.
Delete an access role DELETE
Requires an authenticated browser session with the roles.manage permission. Built-in roles and roles assigned to users cannot be deleted; deleting a role also deletes its conditional inventory rules.