Roles & Permissions

Base URL: https://your-domain.com/api/v1

Requires HTTP Basic Auth.

Role code

Each role has a numeric code — this is the identifier used everywhere (it's what staff accounts and the permission set reference). Use the code, not the internal row id.

Roles

List

GET /api/v1/role/list — All admin/staff roles.

• 200: [ { "id": 20, "code": 5, "name": "Support Agent" } ]

Get

GET /api/v1/role/get/{code} — Single role by code. 404 if not found.

Create

POST /api/v1/role/create — Params: name (required). Auto-assigns the next code.

• 200: { "success": "Role Successfully Created.", "id": 20, "code": 5 }

Update

POST /api/v1/role/update — Params: code (required), name (required).

Delete

DELETE /api/v1/role/delete/{code} — Blocked if staff are assigned to the role (400).

Permissions

Permissions are a set of on/off flags (one per capability) attached to a role.

Get permissions

GET /api/v1/role/permissions/{code} — The full permission set for a role.

• 200: { "role_code": 5, "permissions": { "hrm_module": 1, "notice_add_new": 0, … } } (or "permissions": null if none set yet)

Update permissions

POST /api/v1/role/permissions_update

• Params: role_code (required), plus any permission flags as 0/1 (e.g. notice_add_new=1, hrm_module=0).
• Only recognised permission flags you actually send are changed; everything else is left as-is.
• 200: { "success": "Permissions Successfully Updated.", "updated_fields": [ "notice_add_new", "hrm_module" ] }

cURL

curl -X POST "https://your-domain.com/api/v1/role/permissions_update" \
  -u "user:pass" \
  -d "role_code=5" -d "notice_add_new=1" -d "notice_view=1"

Discovering flag names

Call Get permissions first to see the exact flag names available on your installation, then send the ones you want to change.