User rights management

Overview

The user access management system gives you fine-grained control over who can access which application resources. It uses role-based access control (RBAC): users are assigned to groups, and access rights are granted to those groups. This keeps access management efficient and secure.

Group management

Creating a new group

1. Go to the groups section:
   • Open the Groups tab.
2. Add a group:
   • Click Create Group.
   • Enter a descriptive name and a marker.
   • Assign initial access rights.

warning

A new project always includes a Guest group with a default set of restrictions.

Group editor tabs

The group editor has the following tabs: Basic data, Attributes, Groups, Permissions, Final permissions, and Version History.

Besides the name and marker, the Basic data tab has a Do not use permissions for this group checkbox. When it is selected, users in the group get full access to all Content API controllers except those that require authorization.

Access rights inheritance

The "Groups" tab shows existing groups as a hierarchy. You can connect a new group to an existing one so that it inherits rights from that parent group.

warning

If the parent group has a restriction on a path and the child group overwrites the same restriction, the child group's restriction applies, but only if the "Final permission" option is not set in the parent group.

Only one group in the chain

You can specify a group only if neither a parent nor a child group is already selected.

Modifying access rights

The "Permissions" tab is the main place to edit access rights.

Grouping of rights

If you specified a parent group to inherit rights from, all of its access settings appear in the table at the top, and you cannot edit inherited rights. Rights with exceptions and unused rights are grouped separately in the same table.

Delay in applying rights

Changes to rights do not take effect immediately. It usually takes no more than 5 minutes.

Bulk actions

The "Permissions" tab has buttons for bulk operations:

• Copy permissions from another group: adds all permissions of the selected source group to the current group. Existing permissions are kept, and duplicates are skipped.
• Grant all permissions: grants the group every existing permission. Permissions that are already granted stay unchanged.
• Revert bulk operation: rolls back the last bulk operation (granting all permissions or copying). Only the permissions added by that operation are removed; manual settings are kept.

The application asks for confirmation before each operation.

Access rights management

Creating and editing access rights

To create a right, click "Create Right" on the "Permissions" tab.

An access right is a combination of a method and a path.

1. Create a minimum set of permissions:
   • Generates the minimum required set of permissions, which makes creating rights easier.

warning

Available only if the group has no permissions yet.

2. Set data output restrictions:
   • Applies only when "Create a minimum set of permissions" is selected. Restricts the data returned.

tip

The number of records is set in the settings.

3. API section:
   • Required when you create a new access right. Specifies the route for choosing permissions.
4. Path:
   • Available only after you select an API section. Narrows down the route you set rights for.
5. Name:
   • Required. The name of the right.
6. Methods table (Additional conditions block):
   • Here you choose HTTP methods for the specified path. The Get data (GET) cell has the options without restrictions and with restriction on the number of records; other methods (for example, Add data for POST) are enabled with a checkbox. If a method is not available for the path, its cell shows "not available for selection".

Always 4 methods

The table always lists 4 methods for any path: GET, POST, PUT, DELETE.

7. Additional conditions These conditions appear only for "list" paths, not for all paths, and let you set exceptions for the returned documents.

   • For example, to grant permission for all pages with an exception, click "Select which data you want to exclude". In the window that opens, select the data to restrict access to.

   The examples below show how to set restrictions for this task: restrict the "Guest" group's permission to the "Personal Account" page and to the "Price" and "Personal discount" attributes.

   

   Example 1: restricting Guest group access to specific pages

   Open the "Guest" group for editing. Then open the "Permissions" tab and find "Retrieve all page objects containing product information as an array" in the table of created permissions.

   warning

   The "Guest" group has this access by default. If your group does not have it, create a new access. To do this, click "Create Access" and select the following parameters in the modal window: API section: pages Path: "Retrieve all page objects containing product information as an array"

   Then select "without restrictions" and open the list of pages you want to restrict by clicking "Select which data you need". Set the restriction for the "Personal Account" page.

   

   After selecting the pages, remember to select the "Exclude" option and, if rights can be inherited, "Final permission" as needed.

   The complete setup should look like this:

   

   The access setup is complete. After you click "Save", all unauthorized users get only 3 pages instead of 4.

   Example 2: restricting Guest group access to specific attributes

   Open the "Guest" group for editing. Then open the "Permissions" tab and find "Retrieve all attributes with data from the attribute set" in the table of created permissions.

   warning

   The "Guest" group has this access by default. If your group does not have it, create a new access. To do this, click "Create Access" and select the following parameters in the modal window: API section: attributes-sets Path: "Retrieve all attributes with data from the attribute set"

   Then select "without restrictions" and open the list of attributes you want to restrict by clicking "Select which data you need". Set the restriction for the "Price" and "Personal discount" attributes.

   warning

   This list shows all created attributes from all attribute sets.

   

   After selecting the attributes, remember to select the "Exclude" option and, if rights can be inherited, "Final permission" as needed.

   The complete setup should look like this:

   

   The access setup is complete. After you click "Save", all unauthorized users get limited information when they request product information.

   Example 3: restricting Guest group access to a block

   Open the "Guest" group for editing. Then open the "Permissions" tab and find "Retrieve all block objects" in the table of created permissions.

   warning

   The "Guest" group has this access by default. If your group does not have it, create a new access. To do this, click "Create Access" and select the following parameters in the modal window: API section: blocks Path: "Retrieve all block objects"

   Then select "without restrictions" and open the list of blocks you want to restrict by clicking "Select which data you need".

   warning

   This list shows all created blocks from all block groups.

   

   After selecting the block, remember to select the "Exclude" option and, if rights can be inherited, "Final permission" as needed.

   The complete setup should look like this:

   

   The block access setup is complete.

   – Retrieve all administrator user objects. – Retrieve all objects from attribute sets. – Retrieve all attributes with data from the attribute set. – Retrieve all page objects containing product information as an array. – Retrieve all block objects. – Retrieve all form objects. – Return all product subscriptions. – Retrieve all objects from the order repository. – Search for all objects with a product status. – Retrieve all template objects filtered by type. – Retrieve all template preview objects. – Get all collections.

   Once you select data to exclude, two new options appear: "Exclude": the selected data is excluded. "Final permission": the right is not inherited anywhere down the chain of child groups (available only when "Exclude" is selected).

warning

Additional conditions depend on the selected path and are not always available. When they are, the path has the "Exceptions available for selection" marker.

The Additional Options block of the right's window has an IP Check checkbox.

By default, new rights go to the "Unused Rights" section. To activate a right, select the checkbox to the left of its name.

To open the editor, use

To delete, use

Understanding access rights

Access rights are detailed settings that define which actions a group can perform on specific resources. They are organized by API section and can be further refined with conditions.

Searching for rights in the table

To find rights in the table, enter text in the Search permission field, select API sections in the API Section selector, and use the Show only unused (only unused rights) and Only routes with available exceptions (only paths that have exceptions available) filters.

Final rights

The final permissions tab is an informational table that you can filter by API section to find rights faster.

How to add a user to a group