Permissions Model

┌───────────────────────────────────────────────────────────┐
│                       API Key                              │
│  ┌─────────────────────────────────────────────────────┐  │
│  │                    Instances                         │  │
│  │  ┌───────────────────────────────────────────────┐  │  │
│  │  │                  Services                      │  │  │
│  │  │  ┌─────────────────────────────────────────┐  │  │  │
│  │  │  │               Entities                   │  │  │  │
│  │  │  │  ┌───────────────────────────────────┐  │  │  │  │
│  │  │  │  │           Operations               │  │  │  │  │
│  │  │  │  │   list | get | create | update |  │  │  │  │  │
│  │  │  │  │   delete                          │  │  │  │  │
│  │  │  │  └───────────────────────────────────┘  │  │  │  │
│  │  │  └─────────────────────────────────────────┘  │  │  │
│  │  └───────────────────────────────────────────────┘  │  │
│  └─────────────────────────────────────────────────────┘  │
└───────────────────────────────────────────────────────────┘

api_key: Backend Service
permissions:
  production:                          # Instance
    API_BUSINESS_PARTNER:            # Service
      A_BusinessPartner:             # Entity
        - list                       # Operations
        - get
        - create
        - update

api_key: Full Access Key
permissions:
  # Production - Read only
  production:
    API_BUSINESS_PARTNER:
      A_BusinessPartner:
        - list
        - get
      A_BusinessPartnerAddress:
        - list
        - get

    API_SALES_ORDER_SRV:
      A_SalesOrder:
        - list
        - get
      A_SalesOrderItem:
        - list
        - get

  # Development - Full access
  dev:
    API_BUSINESS_PARTNER:
      "*":                           # All entities
        - list
        - get
        - create
        - update
        - delete

    API_SALES_ORDER_SRV:
      "*":
        - list
        - get
        - create
        - update
        - delete

API_BUSINESS_PARTNER:
  "*":
    - list
    - get

dev:
  "*":
    "*":
      - list
      - get

1. Does key have access to instance?
   └─ No → 403 Forbidden

2. Does key have access to service?
   └─ No → 403 Forbidden

3. Does key have access to entity?
   └─ No → 403 Forbidden

4. Does key have access to operation?
   └─ No → 403 Forbidden

5. ✓ Request allowed

Instance: production ✓ (has access)
Service: API_BUSINESS_PARTNER ✓ (has access)
Entity: A_BusinessPartner ✓ (has access)
Operation: list ✓ (has list permission)
→ Request allowed

Instance: production ✓
Service: API_BUSINESS_PARTNER ✓
Entity: A_BusinessPartner ✓
Operation: delete ✗ (no delete permission)
→ 403 Forbidden

{
  "error": {
    "code": "FORBIDDEN",
    "message": "API key does not have access to instance 'production'"
  }
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "API key does not have access to entity 'A_BusinessPartner'"
  }
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "API key does not have 'delete' permission for 'A_BusinessPartner'"
  }
}

# Good - Specific permissions
A_BusinessPartner:
  - list
  - get

# Avoid - Unnecessary permissions
A_BusinessPartner:
  - list
  - get
  - create
  - update
  - delete  # Not needed for reporting

# Production - Read only
production:
  API_BUSINESS_PARTNER:
    "*":
      - list
      - get

# Development - Full access for testing
dev:
  API_BUSINESS_PARTNER:
    "*":
      - list
      - get
      - create
      - update
      - delete

# Analytics key - Read only everywhere
analytics_key:
  production:
    "*":
      "*":
        - list
        - get

# Integration key - Write access to specific entities
integration_key:
  production:
    API_SALES_ORDER_SRV:
      A_SalesOrder:
        - list
        - get
        - create
        - update

permissions:
  production:
    "*":
      "*":
        - list
        - get
rate_limits:
  per_minute: 30
  per_day: 5000

permissions:
  production:
    API_SALES_ORDER_SRV:
      A_SalesOrder:
        - list
        - get
        - create
      A_SalesOrderItem:
        - list
        - get
        - create
    API_BUSINESS_PARTNER:
      A_BusinessPartner:
        - list
        - get

permissions:
  production:
    API_BUSINESS_PARTNER:
      "*":
        - list
        - get
        - create
        - update
    API_PRODUCT_SRV:
      "*":
        - list
        - get
        - create
        - update

permissions:
  sandbox:
    "*":
      "*":
        - list
        - get
        - create
        - update
        - delete
  dev:
    "*":
      "*":
        - list
        - get
        - create
        - update
        - delete