Permissions
Each API client has boolean permissions plus a tenant entitlement. Grant the minimum a given integration needs.
Permissions
Access is the intersection of three checks:
- Client enabled and key valid
- Tenant allow-list and
platform.apientitlement - Permission flag on the client (optionally overridden per tenant)
A missing flag returns PERMISSION_DENIED (403).
Permission flags
| Flag | Endpoints |
|---|---|
users | GET /users |
cdr | GET /cdr |
contacts | GET / POST /contacts |
click2dial | POST /click2dial |
chat | Chat conversations and messages |
files | GET /files |
calendar | GET / POST /calendar |
fax | GET /fax |
presence | GET / PUT /presence |
There is no separate read/write split. If a client has contacts, it can list and create contacts. Keep write-capable flags off for reporting-only keys.
Entitlement
platform.api is a tenant capability (REST API). Keys cannot bypass a tenant that does not have API access. Typical codes: ENTITLEMENT_REQUIRED, SUBSCRIPTION_INACTIVE.
Least privilege
| Integration | Suggested flags |
|---|---|
| CRM click-to-dial | click2dial, optionally users and contacts |
| Nightly call export | cdr only |
| Directory sync | users, presence |
| Helpdesk chat | chat, users |
Ask your operator to set the flags when they create the client. They can also restrict the client to one tenant.
User-scoped writes
Permissions authorize the client. User-scoped operations still run as X-User-Email. Click-to-dial uses that user's extension; chat and calendar use that user's memberships. The client cannot impersonate a user who is not in the tenant.