Authorization API
Advanced household roles, groups, and membership access administration
List household authorization groups
Requires groups.manage. Groups grant nothing until a roles.manage actor explicitly binds a role to one.
Create an unbound household authorization group
Requires groups.manage and an exact same-origin proof for cookie requests. A new group is inert until a separately authorized role binding is added.
Remove a household member from a group
Requires groups.manage and an exact same-origin proof for cookie requests. A removal may target a suspended member, allowing access cleanup after suspension.
Add an active household member to a group
Requires groups.manage and an exact same-origin proof for cookie requests. Before the add, the group's cumulative permissions must be a subset of the actor's effective permissions.
Remove a role binding from a household group
Requires roles.manage and an exact same-origin proof for cookie requests.
Bind a role to a household group
Requires roles.manage and an exact same-origin proof for cookie requests. The actor may bind only a role whose complete permission set they already possess.
List the bounded household member directory
Requires members.read. It returns local display names and usernames, opaque principal identifiers, access state, and separate direct and group-inherited role identifiers. External identity claims and invitation credentials are never exposed.
Update a member display name or local username
Requires identity.manage, an exact same-origin proof, and an ordinary current session. The patch is atomic, at least one non-null field is required, local usernames are normalized and unique, and external identity claims are never changed. The actor must strictly dominate the target member.
Remove a direct role binding from a household member
Requires roles.manage and an exact same-origin proof for cookie requests. A removal may target a suspended member, allowing access cleanup after suspension.
Bind a role directly to an active household member
Requires roles.manage and an exact same-origin proof for cookie requests. The actor may assign only a role whose complete permission set is already a subset of the actor's effective permissions.
Suspend or reactivate a household member
Requires members.manage and an exact same-origin proof for cookie requests. The installation owner is protected from state changes through this endpoint so the break-glass local owner remains active.
List the fixed permission vocabulary for custom roles
Requires roles.manage. The returned codes are application-owned; custom roles cannot introduce a new code that has no server-side enforcement point.
List built-in and household custom roles
Requires roles.manage. Built-in roles are immutable; custom-role permissions remain explicit and local to this household.
Create a household custom role
Requires roles.manage and an exact same-origin proof for cookie requests. Every requested permission must be one the acting member already has; built-in roles remain immutable.