Permissions - Noyax API

Every API key has permissions per module. Permissions are assigned to the key by Noyax and embedded in the token when it is issued.

Permission	Allowed operations
Read	`GET` requests
Write	`POST`, `PUT`, `DELETE` requests

A key can have read, write, both or no permission for a module. Read does not include write, and write does not include read.

Modules

Module	Endpoints	Status
Definitions	`/definitions`	Reading is open to any valid key; create, update and delete require write permission in any module
Customer	`/customers`, its sub-records and customer definitions	Available
Product	`/products`, its sub-records, groups and parameter definitions	Available
Invoice		Coming soon
Stock	`/stock/warehouses` and sections	Available

Missing permission

If the token is valid but the key lacks the required permission for the module, the API returns 403:

{
  "Success": false,
  "ResultCode": "0110",
  "Message": "You do not have permission for this operation.",
  "Errors": [
    { "Code": "0110", "Message": "You do not have permission for this operation." }
  ]
}

If your key’s permissions change, the change takes effect when you get a new token. Log in again to apply it immediately.

API permissions are independent of the role permissions of the user sent in X-UserID. The user determines on whose behalf operations are made and which records are visible (sharing codes).