Roles & Permissions
Role-based access control (RBAC). Roles group permissions (RoleProperties) that gate every protected endpoint. Roles route: /api/v1/roles
Endpoints
| Method | Route | Permission | Description |
|---|---|---|---|
| GET | /api/v1/roles | Role:View | All roles ordered by name |
| GET | /api/v1/roles/lookup | — | Active roles for dropdowns |
| GET | /api/v1/roles/{id} | Role:View | Single role with permissions |
| POST | /api/v1/roles/create | Role:Create | Create new role |
| PUT | /api/v1/roles/update | Role:Edit | Update existing role |
| DEL | /api/v1/roles/delete/{id} | Role:Delete | Delete a role |
| GET | /api/v1/roles/{roleId}/permissions | Role:View | Get permissions assigned to role |
| PUT | /api/v1/roles/{roleId}/permissions | Role:ModifyPermissions | Replace all permissions for a role |
| GET | /api/v1/roles/properties | Role:View | All RoleProperty records (permission definitions) |
POST
/api/v1/roles/create
JSON Request
{
"name": "Marketing Manager",
"description": "Can manage campaigns and templates",
"isActive": true
}PUT
/api/v1/roles/{roleId}/permissions
Replaces all permissions for a role. Provide an array of RoleProperty IDs to assign.
JSON Request
{
"propertyIds": [
"guid-of-property-1",
"guid-of-property-2"
]
}RBAC Concept
RoleProperty (Module + Action permission definition)
│ defined by SuperFirm via /admin/roleproperty
▼
Role (group of permissions)
│ created per firm
▼
FirmUser → assigned a Role
│
▼
[RequirePermission] filter on controller
│ checks token claims vs Role's PropertyIds
▼
Allow or 403 Forbidden
Permission Modules
| Module | Available Actions |
|---|---|
Users | View, Create, Edit, Delete |
Role | View, Create, Edit, Delete, ModifyPermissions |
Contact | View, Create, Edit, Delete, Import, ChangeTag |
WhatsappChat | View, SendMessage, SendTemplate, StartConversation |
WhatsappTemplate | View, Create, Edit, Delete |
WhatsappCampaign | View, Create, Edit, Delete, Execute |
Workflows | View, Create, Edit, Delete, Logs |
Marketplace | WorkflowImport, TemplateImport |
Settings | View, Integrations, EditInfo |
Dashboard | View, QRCodeChange |
Wallet | View |
ApiClient | View, Create, Edit, Revoke, Regenerate |