Rbac Permissions

Category: Admin Base URL: /admin/rbac Authentication: Required Routes: 12 routes documented

Overview#

This section documents 12 API routes for rbac permissions.

⚠️ These endpoints operate on your live store. POST/PUT/DELETE operations here — including sync, push, resync, and cache operations — modify or delete production data, and some trigger downstream effects such as warehouse orders or customer emails. DELETE operations are generally irreversible. Verify IDs and parameters carefully before calling them from scripts.

Quick Reference#

Method	Endpoint	Description
GET	`/admin/rbac/categories`	No description
POST	`/admin/rbac/categories`	No description
DELETE	`/admin/rbac/categories`	No description
POST	`/admin/rbac/check`	No description
GET	`/admin/rbac/members`	No description
POST	`/admin/rbac/members/assignments`	No description
DELETE	`/admin/rbac/members/assignments`	No description
GET	`/admin/rbac/modules`	// Returns all modules from the module registry
GET	`/admin/rbac/modules/matrix`	// Returns the module access matrix (roles x modules)
GET	`/admin/rbac/permissions`	No description
POST	`/admin/rbac/permissions`	No description
DELETE	`/admin/rbac/permissions`	No description
GET	`/admin/rbac/permissions/:id`	No description
POST	`/admin/rbac/permissions/:id`	No description
DELETE	`/admin/rbac/permissions/:id`	No description
GET	`/admin/rbac/policies`	No description
POST	`/admin/rbac/policies`	No description
GET	`/admin/rbac/roles`	No description
POST	`/admin/rbac/roles`	No description
DELETE	`/admin/rbac/roles`	No description
GET	`/admin/rbac/roles/:id`	No description
POST	`/admin/rbac/roles/:id`	No description
DELETE	`/admin/rbac/roles/:id`	No description
GET	`/admin/rbac/roles/:id/modules`	// Get module permissions for a specific role
POST	`/admin/rbac/roles/:id/modules`	// Create or update module permission for a role
DELETE	`/admin/rbac/roles/:id/modules`	// Remove module permission for a role

GET Admin Rbac Categories#

Endpoint: GET /admin/rbac/categories Authentication: Admin (Required)

Response#

Success:

{
  categories,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/categories' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Categories#

Endpoint: POST /admin/rbac/categories Authentication: Admin (Required)

Request Body#

Field	Type	Required
`type`	enum(predefined, custom)	No

Response#

Success (201):

{
  category,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/categories' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Categories#

Endpoint: DELETE /admin/rbac/categories Authentication: Admin (Required)

Response#

Success (200):

{
  message,
  id,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/categories' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Check#

Endpoint: POST /admin/rbac/check Authentication: Admin (Required)

Request Body#

Field	Type	Required
`urlToTest`	string	Yes

Response#

Success:

{
  can_access,
  can_read,
  can_write,
  can_delete,
  custom_permissions,
}

Also returns:

{
  can_access,
  can_read,
  can_write,
  can_delete,
  custom_permissions,
}

Also returns:

{
  modules,
}

Also returns:

{
  modules,
}

Also returns:

{
  can_access,
  can_read,
  can_write,
  can_delete,
  custom_permissions,
}

Also returns:

{
  can_access,
  can_read,
  can_write,
  can_delete,
  custom_permissions,
}

Also returns:

{
  actorId,
  url,
  allowed,
  denied,
}

Also returns:

{
  actorId,
  url,
  allowed,
  denied,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/check' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Members#

Endpoint: GET /admin/rbac/members Authentication: Admin (Required)

Response#

Success:

{
  members,
  count,
  limit,
  offset,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/members' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Members Assignments#

Endpoint: POST /admin/rbac/members/assignments Authentication: Admin (Required)

Request Body#

Field	Type	Required
`userId`	string	Yes
`roleId`	string	Yes

Response#

Success (200):

{
  message,
  userId,
  roleId,
  previousRole,
}

Error (404):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/members/assignments' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Members Assignments#

Endpoint: DELETE /admin/rbac/members/assignments Authentication: Admin (Required)

Response#

Success (200):

{
  message,
  userId,
  roleId,
}

Error (404):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/members/assignments' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Modules#

Endpoint: GET /admin/rbac/modules Authentication: Admin (Required)

Description#

// Returns all modules from the module registry

Response#

Success:

{
  modules,
  total,
}

Error (500):

{
  message,
  code,
  error,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/modules' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Modules Matrix#

Endpoint: GET /admin/rbac/modules/matrix Authentication: Admin (Required)

Description#

// Returns the module access matrix (roles x modules)

Response#

Success:

{
  matrix,
  roles,
  modules,
  modulePermissions,
}

Error (500):

{
  message,
  code,
  error,
  stack,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/modules/matrix' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Permissions#

Endpoint: GET /admin/rbac/permissions Authentication: Admin (Required)

Response#

Success:

{
  permissions,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/permissions' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Permissions#

Endpoint: POST /admin/rbac/permissions Authentication: Admin (Required)

Request Body#

Field	Type	Required
`name`	string	Yes
`type`	enum(predefined, custom)	Yes
`matcherType`	enum(api)	Yes
`matcher`	string	Yes
`actionType`	enum(read, write, delete)	Yes
`category`	object	No

Response#

Success (201):

{
  permission,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/permissions' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Permissions#

Endpoint: DELETE /admin/rbac/permissions Authentication: Admin (Required)

Response#

Success (200):

{
  message,
  id,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/permissions' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Permissions :id#

Endpoint: GET /admin/rbac/permissions/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success:

{
  permission,
}

Error (400):

{
  message,
  code,
}

Error (404):

{
  message,
  code,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/permissions/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Permissions :id#

Endpoint: POST /admin/rbac/permissions/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Request Body#

Field	Type	Required
`id`	string	Yes
`name`	string	Yes
`matcher`	string	No
`actionType`	enum(read, write, delete)	No

Response#

Success:

{
  permission,
}

Error (404):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/permissions/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Permissions :id#

Endpoint: DELETE /admin/rbac/permissions/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success (200):

{
  message,
  id,
}

Error (400):

{
  message,
  code,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/permissions/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Policies#

Endpoint: GET /admin/rbac/policies Authentication: Admin (Required)

Response#

Success:

{
  policies,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/policies' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Policies#

Endpoint: POST /admin/rbac/policies Authentication: Admin (Required)

Request Body#

Field	Type	Required
`roleId`	string	No
`permissionId`	string	No
`type`	enum(allow, deny)	No

Response#

Success (201):

{
  policy,
}

Error (500):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/policies' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Roles#

Endpoint: GET /admin/rbac/roles Authentication: Admin (Required)

Response#

Success:

{
  roles,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/roles' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Roles#

Endpoint: POST /admin/rbac/roles Authentication: Admin (Required)

Request Body#

Field	Type	Required
`name`	string	Yes
`description`	string	No
`is_active`	boolean	No
`policies`	array	No

Response#

Success (201):

{
  role,
}

Error (500):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/roles' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Roles#

Endpoint: DELETE /admin/rbac/roles Authentication: Admin (Required)

Response#

Success (200):

{
  message,
  id,
}

Error (404):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/roles' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Roles :id#

Endpoint: GET /admin/rbac/roles/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success:

{
  role,
  users,
}

Error (400):

{
  message,
  code,
}

Error (404):

{
  message,
  code,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/roles/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Roles :id#

Endpoint: POST /admin/rbac/roles/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Request Body#

Field	Type	Required
`id`	string	Yes
`name`	string	No
`description`	string	No
`is_active`	boolean	No
`policies`	array	No

Response#

Success:

{
  role,
}

Error (404):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/roles/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Roles :id#

Endpoint: DELETE /admin/rbac/roles/:id Authentication: Admin (Required)

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success (200):

{
  message,
  id,
}

Error (400):

{
  message,
  code,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/roles/:id' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

GET Admin Rbac Roles :id Modules#

Endpoint: GET /admin/rbac/roles/:id/modules Authentication: Admin (Required)

Description#

// Get module permissions for a specific role

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success:

{
  roleId,
  modulePermissions,
}

Error (400):

{
  message,
  code,
}

Error (500):

{
  message,
  code,
  error,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/admin/rbac/roles/:id/modules' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

POST Admin Rbac Roles :id Modules#

Endpoint: POST /admin/rbac/roles/:id/modules Authentication: Admin (Required)

Description#

// Create or update module permission for a role

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Request Body#

Field	Type	Required
`moduleId`	string	Yes
`canAccess`	boolean	No
`canRead`	boolean	No
`canWrite`	boolean	No
`canDelete`	boolean	No
`customPermissions`	record	No

Response#

Success:

{
  message,
  permission,
}

Also returns (201):

{
  message,
  permission,
}

Error (400):

{
  message,
  code,
}

Error (400):

{
  message,
  code,
  errors,
}

Error (500):

{
  message,
  code,
  error,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/admin/rbac/roles/:id/modules' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'

DELETE Admin Rbac Roles :id Modules#

Endpoint: DELETE /admin/rbac/roles/:id/modules Authentication: Admin (Required)

Description#

// Remove module permission for a role

URL Parameters#

Parameter	Type	Required	Description
`id`	string	Yes	Id identifier

Response#

Success:

{
  message,
  roleId,
  moduleId,
}

Error (400):

{
  message,
  code,
}

Error (404):

{
  message,
  code,
}

Error (500):

{
  message,
  code,
  error,
}

Example Request#

curl -X DELETE 'https://your-store.omnicart.cc/admin/rbac/roles/:id/modules' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json'