Permissions

Manage granular project-level and environment-level access permissions for team members. Permissions control what actions each user can perform on specific projects and environments.

Permission Levels

Level	View	Deploy	Manage	Delete
view_only	Yes	—	—	—
deploy	Yes	Yes	—	—
full_access	Yes	Yes	Yes	Yes

Role bypass

Users with the owner or admin team role bypass all permission checks and have full access to everything.

Project Permissions

List Project Permissions

GET /api/v1/permissions/project

Parameter	Type	Description
project_uuid	string	Filter by project UUID
user_id	integer	Filter by user ID

Response:

{
  "data": [
    {
      "id": 1,
      "project_uuid": "proj-abc123",
      "project_name": "My Project",
      "user_id": 5,
      "user_name": "John Doe",
      "user_email": "[email protected]",
      "can_view": true,
      "can_deploy": true,
      "can_manage": false,
      "can_delete": false,
      "permission_level": "deploy",
      "created_at": "2024-01-15T10:30:00Z",
      "updated_at": "2024-01-15T10:30:00Z"
    }
  ]
}

Get Project Permission

GET /api/v1/permissions/project/{id}

Grant Project Access

POST /api/v1/permissions/project

{
  "project_uuid": "proj-abc123",
  "user_id": 5,
  "permission_level": "deploy"
}

Parameter	Type	Required	Description
project_uuid	string	Yes	UUID of the project
user_id	integer	Yes	ID of the user to grant access
permission_level	string	Yes	view_only, deploy, or full_access

Response: 201 Created

{
  "message": "Project access granted.",
  "data": {
    "id": 1,
    "project_uuid": "proj-abc123",
    "user_id": 5,
    "can_view": true,
    "can_deploy": true,
    "can_manage": false,
    "can_delete": false
  }
}

Error: 409 Conflict if the user already has access to the project.

Update Project Permission

PUT /api/v1/permissions/project/{id}

{
  "permission_level": "full_access"
}

Response:

{
  "message": "Project permission updated.",
  "data": {
    "id": 1,
    "project_uuid": "proj-abc123",
    "user_id": 5,
    "can_view": true,
    "can_deploy": true,
    "can_manage": true,
    "can_delete": true
  }
}

Revoke Project Access

DELETE /api/v1/permissions/project/{id}

Response:

{
  "message": "Project access revoked."
}

Bulk Operations

Grant Access to All Team Members

Grant project access to all current team members at once:

POST /api/v1/permissions/project/bulk

{
  "project_uuid": "proj-abc123",
  "permission_level": "view_only"
}

Response:

{
  "message": "Access granted to 5 team members.",
  "count": 5
}

Revoke All Project Access

Remove all user access from a project:

DELETE /api/v1/permissions/project/bulk/{project_uuid}

Response:

{
  "message": "All project access revoked.",
  "count": 5
}

Environment Permissions

Environment permissions override project-level permissions for a specific environment. When no environment override exists, the project-level permission applies.

List Environment Permissions

GET /api/v1/permissions/environment

Parameter	Type	Description
environment_id	integer	Filter by environment ID
user_id	integer	Filter by user ID

Response:

{
  "data": [
    {
      "id": 1,
      "environment_id": 10,
      "environment_name": "production",
      "project_uuid": "proj-abc123",
      "user_id": 5,
      "user_name": "John Doe",
      "can_view": true,
      "can_deploy": false,
      "can_manage": false,
      "can_delete": false,
      "created_at": "2024-01-15T10:30:00Z"
    }
  ]
}

Create Environment Override

POST /api/v1/permissions/environment

{
  "environment_id": 10,
  "user_id": 5,
  "permission_level": "view_only"
}

Parameter	Type	Required	Description
environment_id	integer	Yes	Environment ID
user_id	integer	Yes	User ID
permission_level	string	Yes	view_only, deploy, or full_access

Response: 201 Created

{
  "message": "Environment permission override created.",
  "data": {
    "id": 1,
    "environment_id": 10,
    "user_id": 5,
    "can_view": true,
    "can_deploy": false,
    "can_manage": false,
    "can_delete": false
  }
}

Delete Environment Override

Removes the override, reverting to project-level permissions:

DELETE /api/v1/permissions/environment/{id}

Response:

{
  "message": "Environment permission override removed."
}

Example: Restricting Production Access

A common pattern is to give developers full access at the project level but restrict production to view-only:

# Grant full access at project level
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"project_uuid":"proj-abc","user_id":5,"permission_level":"full_access"}' \
  https://app.corelix.io/api/v1/permissions/project

# Override: view-only on production environment
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"environment_id":10,"user_id":5,"permission_level":"view_only"}' \
  https://app.corelix.io/api/v1/permissions/environment

The developer can deploy to staging and development but can only view production resources.