Restricted Scope

Restricted Scope applies Entity Permissions to resource queries and individual operations. The affected resource documentation identifies the required permission key and any ownership or administration alternatives.

Query Filtering

Permission filtering is endpoint-specific. List and show operations can return only accessible resources, while administration endpoints can use another permission key or apply documented privileged access. A grant for one operation does not imply access to another operation.

Direct Access

Directly controlled resources evaluate their own Entity Permissions. They can expose an entityPermissions relation, and their Restricted Scope matches grants for the authenticated User, Role, or accessible Departments.

Inherited Access

Dependent resources can apply the Restricted Scope of a documented parent relation. The dependent resource does not necessarily expose or persist independent Entity Permissions.

Permission Input

Documented create and update endpoints for directly controlled resources may accept entity_permissions. The value is an array of permission definitions; the endpoint derives the target resource from the resource being created or updated.

The following example grants the view key to two users:

[
  {
    "key": "view",
    "permission_entity": "user",
    "permission_entity_id": 25
  },
  {
    "key": "view",
    "permission_entity": "user",
    "permission_entity_id": 26
  }
]

Only send entity_permissions where the endpoint's Request Keys document it. Supported permission keys and permission-entity types remain resource-specific.