Skip to content
This page View Markdown Open in ChatGPT Open in Claude

API group permissions

A group is a list of what may be called : tables and their APIs, fields readable and writable, custom APIs, system APIs, third party APIs, WebSocket events. An API user gets groups ; a person of your users table gets groups through the groupsColumn of its auth provider. A call passes when the API user grants it and, when a person is involved, the person too.

Two tokens, two gates : the API user (which application) and the person (which rows) 1 · get the tokens POST …/system-api/admin/token { "u": "shop_app", "p": "…" } an API user of API Maker → x-am-authorization POST …/system-api/admin/token { "name": "users_tg", "u": "alice", "p": "…" } a row of your users table → x-am-user-authorization Google, Azure AD, AWS Cognito and custom providers give the person token too : x-google-authorization… 2 · call an API with both GET /api/schema/admin/shop/main/orders x-am-authorization: eyJ… x-am-user-authorization: eyJ… Public APIs (IS_PUBLIC) need no token. Token access needs the API user, and the person only when the settings name an auth provider. 3 · two gates in API Maker API gate · the groups of the API user may this application call this API of this table ? which fields it may read and write · 403 when no group grants it Row gate · your pre hook of the rows this API reaches, which are this person's ? g.req.auth.authAMDB → find = { owner: person.id } only the rows of Alice, only the fields her app may see 401 : token missing or expired · 403 : no group grants the API
Page API Security → API Group Permissions : the groups on the left, the tree of the account on the right.
Grants Instances → databases → tables → APIs, and the fields of a table with R and W ; custom APIs ; system APIs ; third party APIs ; WebSocket events.
Shortcuts All APIs, All Fields, All Third Party APIs and the checkbox of a column check everything below it. New tables and APIs are covered by an "all" grant.
Refused with 403 when no group of the caller grants the API ; a field not readable is absent from the answer, a field not writable is refused on save.

Make a group

  1. Add New, give a unique name, Save Group. Clone copies an existing group.
  2. Open the tree. Each API shows how it is reachable, from its settings : Public, AM-User (API user token), DB-User (person token), Google, Azure, or No-Access.
  3. Check the APIs and, under a table, the fields : R to read them, W to write them.
  4. Save group settings. Active API users in this group shows who has it.

Give it

  • To an API user : the groups list on the API User Permissions page.
  • To a person : write the group names, comma separated, in the column named by groupsColumn of the auth provider. * gives the person every group of the API user.

Good to know

  • The pre and post hooks of an API can be limited to some groups : they run only for callers of those groups.
  • The APIs Security Report lists the groups which reach too far.
  • Groups go to Git : the same permissions on every environment.