Developers
Roles and permissions
How access is decided: areas, the view, write and admin levels, and how to read your own.
MantraWorx decides access per area of the product. Each area has a key, and each person holds one of three levels on it.
The three levels#
| Level | What it allows |
|---|---|
view | Read what you have access to. |
write | Create and edit. Includes view. |
admin | Manage and delete. Includes write and view. |
If you hold no level for an area, requests to it return 403.
Some of the keys#
| Key | Area |
|---|---|
worx.projects, worx.stories, worx.tasks, worx.sprints | WorxCenter |
hr.employees, hr.leave, hr.performance | People and HR |
hr.payroll, finance.salary, finance.reimbursement | Finance |
docs.documents | Documents |
chat.messages | WorxTalk |
admin.users, admin.roles, admin.departments | Admin and access |
analytics.reports | Reports |
This is a short list. There are more keys, and your administrator controls which levels each role holds. To see yours, ask the API.
Read your own permissions#
GET /api/users/me/permissions
The response maps each key to your level. It is shown here with example values.
{
"permissions": {
"docs.documents": "write",
"worx.tasks": "write",
"hr.leave": "view"
},
"headedDepartmentIds": [],
"hasManagedUsers": false
}When access is refused#
A call you are not allowed to make returns 403. The body names what was needed, so you can show a useful message.
{
"error": "Insufficient permissions",
"required": "write",
"component": "docs.documents",
"reason": "…"
}Tip: Check your permissions once after sign-in, and hide actions you cannot use. The server still checks every request, so hiding a button never replaces the check.
Need more help?
Can’t find what you need? Talk to the team.