Appearance
Permissions & Policies API
Permissions
Base route: /api/permissions
Auth required: ✅ JWT Bearer
Permissions are read-only through the API. New permissions are only added via seed migration scripts.
GET /api/permissions
Returns all defined permissions.
Permission: Permission:Read
Response 200 OK
json
[
{ "id": 1, "collection": "Vendor", "action": "Read", "description": "View vendors" },
{ "id": 2, "collection": "Vendor", "action": "Create", "description": "Create vendors" },
{ "id": 3, "collection": "Vendor", "action": "Update", "description": "Update vendors" },
{ "id": 4, "collection": "Vendor", "action": "Delete", "description": "Delete vendors" },
{ "id": 5, "collection": "Invoice", "action": "Read", "description": "View invoices" },
{ "id": 9, "collection": "Transaction", "action": "Read", "description": "View transactions" },
{ "id": 13, "collection": "Dashboard", "action": "Read", "description": "View dashboard" },
{ "id": 14, "collection": "Setting", "action": "Read", "description": "View settings" },
{ "id": 15, "collection": "Setting", "action": "Update", "description": "Update settings" }
]Policies
Base route: /api/policies
Auth required: ✅ JWT Bearer
A Policy is a named bundle of permissions. Policies are attached to roles or directly to users.
GET /api/policies
Returns all policies.
Permission: Policy:Read
Response 200 OK
json
[
{
"id": 1,
"name": "Vendor Full Access",
"description": "Create, read, update, and delete vendors",
"isActive": true,
"permissions": [
{ "id": 1, "collection": "Vendor", "action": "Read" },
{ "id": 2, "collection": "Vendor", "action": "Create" }
]
}
]GET /api/policies/:id
Returns a single policy with its full permission list.
Response 200 OK — PolicyDto
Response 404 Not Found
POST /api/policies
Creates a new policy.
Permission: Policy:Create
json
{
"name": "Invoice Read Only",
"description": "View invoices and transactions",
"permissionIds": [5, 9]
}Response 201 Created — PolicyDto
PUT /api/policies/:id
Updates a policy's name, description, and permission list.
Permission: Policy:Update
Response 200 OK — Updated PolicyDto
Response 404 Not Found
DELETE /api/policies/
Soft-deletes a policy.
Permission: Policy:Delete
Response 204 No Content
Response 404 Not Found
POST /api/policies/:id/permissions/:permissionId
Adds a permission to a policy.
Permission: Policy:Update
Response 204 No Content
DELETE /api/policies/:id/permissions/:permissionId
Removes a permission from a policy.
Permission: Policy:Update
Response 204 No Content
POST /api/roles/:roleId/policies/:policyId
Attaches a policy to a role.
Permission: Role:Update
Response 204 No Content
DELETE /api/roles/:roleId/policies/:policyId
Detaches a policy from a role.
Permission: Role:Update