Skip to content
This page View Markdown Open in ChatGPT Open in Claude

API group permissions

A group is a list of what may be called : tables and their APIs, fields readable and writable, custom APIs, system APIs, WebSocket events. An API user gets groups ; a person of your users table gets groups through the groupsColumn of its auth provider. A call passes when the API user grants it and, when a person is involved, the person too.

In short

  • A group is a list of what may be called : tables and their APIs, fields, custom APIs, system APIs.
  • Give groups to an API user (an app), or to the people of your app through their auth provider.
  • A call passes only when a group allows it : else 403.
API Group Permissions : from left to right, the group, the kind of API, the instance and database, then the tables
  1. The groups. Pick one.
  2. The kind of API : the APIs of your tables, custom APIs, system APIs.
  3. The instance, then the database.
  4. The tables. Then tick the APIs of each table it may call.
Two tokens, two gates : the API user (which application) and the person (which rows) 1 · get the tokens The application POST …/system-api/admin/token { "u": "shop_app", "p": "…" } an API user of API Maker → x-am-authorization The person POST …/system-api/admin/token { "name": "users_tg", "u": "alice", "p": "…" } a row of your users table → x-am-user-authorization Google, Azure AD, AWS Cognito and custom providers give the person token too : x-google-authorization… 2 · call an API with both GET /api/schema/admin/shop/main/orders x-am-authorization: eyJ… x-am-user-authorization: eyJ… Public APIs (IS_PUBLIC) need no token. Token access needs the API user, and the person only when the settings name an auth provider. 401 · token missing or expired 403 · no group grants the API 3 · two gates in API Maker API gate the groups of the API user may this application call this API of this table ? which fields it may read and write 403 when no group grants it Row gate your pre hook of the rows this API reaches, which are this person's ? g.req.auth.authAMDB find = { owner: person.id } only the rows of Alice, only the fields her app may see
Page Security → API Group Permissions : the groups on the left, the tree of the account on the right.
Grants Instances → databases → tables → APIs, and the fields of a table with R and W ; custom APIs ; system APIs ; WebSocket events.
Shortcuts All APIs, All Fields and the checkbox of a column check everything below it. New tables and APIs are covered by an "all" grant.
Refused with 403 when no group of the caller grants the API ; a field not readable is absent from the answer, a field not writable is refused on save.
API Authorization Without Auth Code: Access Types, API Users, Groups12 chapters and the transcript

Make a group

  1. Add New, give a unique name, Save Group. Clone copies an existing group.
  2. Open the tree. Each API shows how it is reachable, from its settings : Public, AM-User (API user token), DB-User (person token), Google, Azure, or No-Access.
  3. Check the APIs and, under a table, the fields : R to read them, W to write them.
  4. Save group settings. Active API users in this group shows who has it.

Give it

  • To an API user : the groups list on the API User Permissions page.
  • To a person : write the group names, comma separated, in the column named by groupsColumn of the auth provider. * gives the person every group of the API user.

Good to know

  • The pre and post hooks of an API can be limited to some groups : they run only for callers of those groups.
  • The APIs Security Report lists the groups which reach too far.
  • Groups go to Git : the same permissions on every environment.