> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.noyax.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Read and write permissions of an API key, per module.

Every API key has permissions per module. Permissions are assigned to the key by Noyax and embedded in the token when it is issued.

| Permission | Allowed operations               |
| ---------- | -------------------------------- |
| **Read**   | `GET` requests                   |
| **Write**  | `POST`, `PUT`, `DELETE` requests |

A key can have read, write, both or no permission for a module. Read does not include write, and write does not include read.

## Modules

| Module      | Endpoints                                                      | Status                                                                                             |
| ----------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Definitions | `/definitions`                                                 | Reading is open to any valid key; create, update and delete require write permission in any module |
| Customer    | `/customers`, its sub-records and customer definitions         | Available                                                                                          |
| Product     | `/products`, its sub-records, groups and parameter definitions | Available                                                                                          |
| Invoice     |                                                                | Coming soon                                                                                        |
| Stock       | `/stock/warehouses` and sections                               | Available                                                                                          |

## Missing permission

If the token is valid but the key lacks the required permission for the module, the API returns **403**:

```json theme={null}
{
  "Success": false,
  "ResultCode": "0110",
  "Message": "You do not have permission for this operation.",
  "Errors": [
    { "Code": "0110", "Message": "You do not have permission for this operation." }
  ]
}
```

<Info>
  If your key's permissions change, the change takes effect **when you get a new token**. Log in again to apply it immediately.
</Info>

<Note>
  API permissions are independent of the role permissions of the user sent in `X-UserID`. The user determines on whose behalf operations are made and which records are visible ([sharing codes](/en/v1/guides/sharing-codes)).
</Note>