Update a conditional inventory access rule
The API runs on your application instance. Schemas and field names come directly from the OpenAPI specification. Session-authenticated requests require a session on that instance.
Requires an authenticated browser session with the roles.manage permission. Changing a rule revokes user-bound API tokens for its previous and current roles.
adminSessionauthjs.session-token<token>Authenticated Auth.js browser session cookie; each operation declares its required permission. Not restricted to administrators. HTTPS deployments use the secure-prefixed cookie variant.
id*stringInventory access rule identifier.
uuidX-Organization-ID?stringOrganization membership selected for this request. User-bound credentials may select any active membership; standalone tokens may only repeat their pinned organization ID.
uuidapplication/json- body
1 <= propertiesname?string1 <= length <= 160description?stringlength <= 1000roleKey?AccessRoleKeyStable lowercase identifier for a built-in or custom role.
^[a-z][a-z0-9_-]{0,63}$1 <= length <= 64permissions?array<>1 <= items <= 7conditions?array<>Conditions combined with logical AND.
1 <= items <= 12enabled?booleanpriority?integer0 <= value <= 10000Inventory access rule updated
application/json- response
rule*Additive permission grant for matching inventory items. Rules never deny permissions already granted by a role; any matching enabled rule may grant access.
curl -X PATCH 'https://example.com/api/access/rules/497f6eca-6276-4993-bfeb-53cbbbba6f08' \ -H 'Content-Type: application/json' \ -d '{}'{ "rule": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "description": "string", "roleKey": "editor", "permissions": [ "inventory.update" ], "conditions": [ { "field": "status", "operator": "equals", "value": "string" } ], "enabled": true, "priority": 0, "createdBy": "string", "updatedBy": "string", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z" }}Delete a conditional inventory access rule DELETE
Requires an authenticated browser session with the roles.manage permission. Deleting a rule revokes user-bound API tokens for its role.
Count matching physical items in one transient image POST
Requires the ai scope. A selectable server-side Replicate model analyzes the image; text-aware models use itemHint as their query. The result is advisory and does not mutate stock. Supply a stable Idempotency-Key when retrying the same upload so a lost start response cannot create another paid prediction.