Create a conditional inventory access rule
The API runs on your application instance. Schemas and field names come directly from the OpenAPI specification. Session-authenticated requests require a session on that instance.
Requires an authenticated browser session with the roles.manage permission. The rule grants its permissions to members of the selected role only for inventory items that match every condition.
adminSessionauthjs.session-token<token>Authenticated Auth.js browser session cookie; each operation declares its required permission. Not restricted to administrators. HTTPS deployments use the secure-prefixed cookie variant.
X-Organization-ID?stringOrganization membership selected for this request. User-bound credentials may select any active membership; standalone tokens may only repeat their pinned organization ID.
uuidapplication/json- body
Additive item-specific access grant. Multiple enabled rules are ORed; all conditions inside this rule are ANDed.
name*string1 <= length <= 160description?stringlength <= 1000""roleKey*AccessRoleKeyStable lowercase identifier for a built-in or custom role.
^[a-z][a-z0-9_-]{0,63}$1 <= length <= 64permissions*array<>1 <= items <= 7conditions*array<>Conditions combined with logical AND.
1 <= items <= 12enabled?booleantruepriority?integerDisplay and evaluation order; lower values come first and do not override other matching rules.
0 <= value <= 10000100Inventory access rule created
application/json- response
rule*Additive permission grant for matching inventory items. Rules never deny permissions already granted by a role; any matching enabled rule may grant access.
curl -X POST 'https://example.com/api/access/rules' \ -H 'Content-Type: application/json' \ -d '{ "name": "Update XYZ items", "description": "Let members of the ABC role update items whose name contains xyz.", "roleKey": "abc", "permissions": [ "inventory.update" ], "conditions": [ { "field": "name", "operator": "contains", "value": "xyz" } ], "enabled": true, "priority": 100}'{ "rule": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "description": "string", "roleKey": "editor", "permissions": [ "inventory.update" ], "conditions": [ { "field": "status", "operator": "equals", "value": "string" } ], "enabled": true, "priority": 0, "createdBy": "string", "updatedBy": "string", "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z" }}Update an access role PATCH
Requires an authenticated browser session with the roles.manage permission. Changing permissions revokes user-bound API tokens for members of this role. The built-in Admin role must retain every permission.
Delete a conditional inventory access rule DELETE
Requires an authenticated browser session with the roles.manage permission. Deleting a rule revokes user-bound API tokens for its role.