انتقل إلى المحتوى الرئيسي

Role & Permission Endpoints

Manage roles, permissions, and role-permission assignments. Roles define what actions users can perform within a tenant.

Base Paths​

ResourcePath
Roles/api/roles
Role Permissions/api/role-permissions

Built-in Roles​

RoleDescription
SUPER_ADMINFull system access, tenant management
ADMINOrganization management, user management
DATA_ENTRYData input and basic CRUD operations
EMPLOYEEStandard employee with limited access
CANDIDATEJob candidate with minimal access
MANAGERTeam/department management
VIEWERRead-only access

Role Endpoints​

List All Roles​

GET /api/roles
Authorization: Bearer {token}

Response 200 OK:

{
  "items": [
    {
      "id": "uuid",
      "name": "ADMIN",
      "isSystem": true,
      "tenantId": "uuid"
    }
  ],
  "total": 7
}

Find Role by Options​

GET /api/roles/options?name=EMPLOYEE
Authorization: Bearer {token}

Create Role​

POST /api/roles
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "CUSTOM_ROLE"
}

Update Role​

PUT /api/roles/:id
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "UPDATED_ROLE_NAME"
}

Delete Role​

DELETE /api/roles/:id
Authorization: Bearer {token}

Import Roles (Cloud Migration)​

POST /api/roles/import/migrate
Authorization: Bearer {token}
Content-Type: application/json

[
  { "name": "CUSTOM_ROLE_1", "isSystem": false }
]

Role Permission Endpoints​

List Permissions for Role​

GET /api/role-permissions?roleId={roleId}
Authorization: Bearer {token}

Assign Permission to Role​

POST /api/role-permissions
Authorization: Bearer {token}
Content-Type: application/json

{
  "roleId": "uuid",
  "permission": "ORG_USERS_VIEW",
  "enabled": true
}

Update Permission​

PUT /api/role-permissions/:id
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": false
}

Remove Permission from Role​

DELETE /api/role-permissions/:id
Authorization: Bearer {token}

Available Permissions​

CategoryPermissions
OrganizationORG_USERS_VIEW, ORG_USERS_EDIT, ALL_ORG_VIEW, ALL_ORG_EDIT
EmployeesORG_EMPLOYEES_VIEW, ORG_EMPLOYEES_EDIT
TimeTIME_TRACKER, ALLOW_MANUAL_TIME, ALLOW_DELETE_TIME
TasksORG_TASK_VIEW, ORG_TASK_EDIT, ORG_TASK_ADD
ProjectsORG_PROJECT_VIEW, ORG_PROJECT_EDIT, ORG_PROJECT_ADD
SprintsORG_SPRINT_VIEW, ORG_SPRINT_ADD, ORG_SPRINT_EDIT, ORG_SPRINT_DELETE
InvoicesORG_EXPENSES_VIEW, ORG_EXPENSES_EDIT, INVOICES_VIEW, INVOICES_EDIT
CRMVIEW_SALES_PIPELINES, EDIT_SALES_PIPELINES
RolesCHANGE_ROLES_PERMISSIONS
IntegrationINTEGRATION_VIEW, INTEGRATION_EDIT
SystemMIGRATE_GAUZY_CLOUD, ACCESS_DELETE_ACCOUNT, ACCESS_DELETE_ALL_DATA

Data Model​

interface IRole {
  id: string;
  name: string;
  isSystem: boolean;
  tenantId: string;
  rolePermissions?: IRolePermission[];
}

interface IRolePermission {
  id: string;
  roleId: string;
  permission: string;
  enabled: boolean;
  tenantId: string;
}

Permissions​

ActionRequired Permission
View/manage rolesCHANGE_ROLES_PERMISSIONS
View roles (team)ORG_TEAM_ADD