How staff roles and module permissions apply to API calls.
Authenticated partner methods are typically
POST /admin/api/… with a staff token.
See Authentication and API Reference.
Role-based access
Staff roles and module permissions (view/create/edit/delete) can block API operations even when a token is valid.
Module permissions
Examples include projects, invoices, and other modules checked via has_permission().
Best practices
Use least-privilege staff accounts for integrations. See the product guide for roles & permissions.
Was this page helpful?