roles

Mock

Mock. This operation is part of the approved contract but its module is not built yet. Run Core with N1_API_MODE=mock N1_DEV_AUTH=stub to get deterministic demo-shop data from it. The real server answers NOT_IMPLEMENTED until it ships; the schema and examples here will not change when it does.

Every role and its permissions

Compare

Every role and its permissions, for the role picker. Six rows, so not paged.

POST/graphqlapp audience

Who can call this. Owner and admin. You can run it against Local or Staging from the request panel, with a demo-shop token.

Headers

Required Optional

AuthorizationstringRequired
Bearer <token>, issued for this endpoint's audience. The token decides the shop and roles; nothing in the request body can change them.
Example: Bearer eyJhbGciOiJFZERTQSJ9…
Content-TypestringRequired
Always application/json. Only POST is accepted.
Example: application/json
X-Request-IdstringOptional
Your id for this request (8–128 characters of A–Z a–z 0–9 . _ : -). Echoed back in the response header and in every error, so you can quote it when reporting a problem. Core makes one if you send none.
Example: app-7f3c2a9e-checkout

Arguments

This operation takes no arguments.

Returns

Required Optional

roles[RoleInfo!]!Required
Every role and its permissions, for the role picker. Six rows, so not paged.
Show children
- descriptionString!Required
  One line for the role picker.
  Example: "Runs the shop. Everything, including who else can sign in."
- permissions[String!]!Required
  Actions this role may perform, e.g. customers.write.
  Example: ["org.read","org.manage","users.read","users.manage","customers.read","customers.write","customers.delete"]
- roleRoleName!Required
  The role.
  Example: "OWNER"
  - ACCOUNTANTCustomers, invoices and payments.
  - ADMINManages people, settings and customers on the owner’s behalf.
  - OPERATORRuns machines and logs production.
  - OWNERRuns the shop. Everything, including who else can sign in.
  - QCInspects parts and records results.
  - SUPERVISORPlans and watches the shop floor.

Errors

Code	HTTP	When
`FORBIDDEN`	`403`	Signed in, but the role or tenant does not allow the action.

Every error has the same body. See Errors.

Rate limit tier

Tier: per user. Over the limit you get RATE_LIMITED (HTTP 429) with a Retry-After header. See Response handling.

{ "data": { "roles": [ { "role": "OWNER", "description": "Runs the shop. Everything, including who else can sign in.", "permissions": [ "org.read", "org.manage", "users.read", "users.manage", "customers.read", "customers.write", "customers.delete" ] }, { "role": "ADMIN", "description": "Manages people, settings and customers on the owner’s behalf.", "permissions": [ "org.read", "org.manage", "users.read", "users.manage", "customers.read", "customers.write", "customers.delete" ] }, { "role": "ACCOUNTANT", "description": "Customers, invoices and payments.", "permissions": [ "org.read", "customers.read", "customers.write" ] }, { "role": "SUPERVISOR", "description": "Plans and watches the shop floor.", "permissions": [ "org.read", "customers.read" ] }, { "role": "OPERATOR", "description": "Runs machines and logs production.", "permissions": [ "org.read" ] }, { "role": "QC", "description": "Inspects parts and records results.", "permissions": [ "org.read" ] } ] } }