XISUITEDokumentation

Permissions

11 Endpunkte. Basis-URL: https://xapi.ambertech.cloud/api/v1

Check permission(s) for current user#

POST/permissions/checkToken

Single: { permission } → { data: boolean }. Multiple: { permissions, mode } → { data: { allowed, mode, permissions } }

Request-Bodyapplication/jsonCheckPermissionDto

NameTypBeschreibung
permissionstring

Single permission key to check

permissionsstring[]

Multiple permission keys to check

modestring

Werte: allany

Standard: "all"

Antworten

  • 200OK
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/permissions/check" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"permission":"…","permissions":[],"mode":"all"}'

Get current user's effective permissions#

GET/permissions/effectiveToken

Parameter

NameOrtTypBeschreibung
spaceIdQuerystring–
spaceKeyQuerystring–

Antworten

  • 200OK
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/permissions/effective" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Get level permissions#

GET/permissions/levelToken

With userId + hierarchyLevelId: returns current user's level permissions. Without: returns all (admin UI).

Parameter

NameOrtTypBeschreibung
userIdQuerystring–
hierarchyLevelIdQuerystring–
entityTypeQuerystring

Werte: processtask

Antworten

  • 200OK
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/permissions/level" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Save a level permission (admin/owner only)#

POST/permissions/levelToken

Request-Bodyapplication/jsonSaveLevelPermissionDto

NameTypBeschreibung
hierarchyLevelIdobject

Hierarchy level ID. Legacy clients may pass null for the global/default matrix.

entityTypePflichtstring

Entity type: process | task

targetTypePflichtstring

Target type: user | role | group | base_role

targetIdobject

Target entity ID

baseRoleobject

Base role name (for base_role target type)

can_viewboolean–
can_createboolean–
can_editboolean–
can_deleteboolean–
can_view_historyboolean–
can_view_attachmentsboolean–
can_add_attachmentsboolean–
can_delete_attachmentsboolean–
can_view_commentsboolean–
can_add_commentsboolean–
can_delete_commentsboolean–

Antworten

  • 201Erstellt
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/permissions/level" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"entityType":"…","targetType":"…"}'

Delete a level permission (admin/owner only)#

DELETE/permissions/levelToken

Request-Bodyapplication/jsonDeleteLevelPermissionDto

NameTypBeschreibung
idPflichtstring

Level permission ID to delete

Antworten

  • 200OK
Beispiel (cURL)
curl -X DELETE "https://xapi.ambertech.cloud/api/v1/permissions/level" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id":"…"}'

Get menu permissions#

GET/permissions/menuToken

With userId query: returns current user's effective menu entries. Without: returns all entries (admin UI).

Parameter

NameOrtTypBeschreibung
userIdQuerystring–

Antworten

  • 200OK
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/permissions/menu" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Save a menu permission (admin/owner only)#

POST/permissions/menuToken

Request-Bodyapplication/jsonSaveMenuPermissionDto

NameTypBeschreibung
menuKeyPflichtstring

Menu key identifier

targetTypePflichtstring

Target type: user | role | group | base_role

targetIdobject

Target entity ID (for user/role/group)

baseRoleobject

Base role name (for base_role target type)

canViewboolean

Standard: true

Antworten

  • 201Erstellt
Beispiel (cURL)
curl -X POST "https://xapi.ambertech.cloud/api/v1/permissions/menu" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"menuKey":"…","targetType":"…"}'

Bulk save menu permissions (admin/owner only)#

PUT/permissions/menuToken

Request-Bodyapplication/jsonBulkMenuPermissionDto

NameTypBeschreibung
permissionsPflichtSaveMenuPermissionDto[]–
permissions[].menuKeyPflichtstring

Menu key identifier

permissions[].targetTypePflichtstring

Target type: user | role | group | base_role

permissions[].targetIdobject

Target entity ID (for user/role/group)

permissions[].baseRoleobject

Base role name (for base_role target type)

permissions[].canViewboolean

Standard: true

Antworten

  • 200OK
Beispiel (cURL)
curl -X PUT "https://xapi.ambertech.cloud/api/v1/permissions/menu" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"permissions":[]}'

Delete a menu permission (admin/owner only)#

DELETE/permissions/menuToken

Request-Bodyapplication/jsonDeleteMenuPermissionDto

NameTypBeschreibung
idPflichtstring

Menu permission ID to delete

Antworten

  • 200OK
Beispiel (cURL)
curl -X DELETE "https://xapi.ambertech.cloud/api/v1/permissions/menu" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id":"…"}'

Get base role overrides and group permission overrides#

GET/permissions/spacesToken

Response: { overrides, groupOverrides } — no success wrapper.

Antworten

  • 200OK
Beispiel (cURL)
curl -X GET "https://xapi.ambertech.cloud/api/v1/permissions/spaces" \
  -H "Authorization: Bearer $XISUITE_TOKEN"

Bulk save space permissions (admin/owner or can_manage_space_permissions)#

PUT/permissions/spacesToken

Request-Bodyapplication/jsonBulkSpacePermissionDto

NameTypBeschreibung
permissionsPflichtSpacePermissionItemDto[]–
permissions[].permKeyPflichtstring

Permission key to update

permissions[].targetTypePflichtstring

Target type: role | base_role | group

permissions[].targetIdobject

Target entity ID (for role/group)

permissions[].baseRoleobject

Base role name (for base_role target type)

permissions[].valuePflichtboolean

Permission value to set

Antworten

  • 200OK
Beispiel (cURL)
curl -X PUT "https://xapi.ambertech.cloud/api/v1/permissions/spaces" \
  -H "Authorization: Bearer $XISUITE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"permissions":[]}'
Stand: 25. Oktober 2026© 2026 XISUITE · AmberTech Solutions