Permissions
Authorisation is enforced with Spatie roles & permissions and Laravel policy gates. Beyond passing the auth guard, protected routes require the caller to hold a specific ability on a specific model, applied as Authorize:{ability},{model} route middleware.
The model
Users are assigned roles (e.g. admin, agent) per workspace.
Standard CRUD gates: viewAny, view, create, update, delete.
Each model has a Policy that maps abilities to role permissions.
When a caller lacks the required ability the API responds 403 Forbidden. The abilities enforced on each route are shown on every endpoint in the reference. Roles & permission assignment are managed via the Roles & Permissions endpoints.
Ability matrix
Every gated model and the abilities the API checks against it (derived from route middleware).
| Model | Abilities enforced |
|---|---|
| AI.CrawlSchedule | createviewAny |
| AI.DataSource | createviewAny |
| AI.Gpt | createviewAny |
| AI.Suggestion | createviewAny |
| Campaigns.SmsCampaign | createviewAny |
| canresponse | updateview |
| Canresponse.Canresponse | createviewAny |
| contact | deleteupdateview |
| Contacts.Contact | createviewAny |
| Contacts.Segment | createviewAny |
| conversation | deleteupdateview |
| Conversations.Conversation | createviewAny |
| crawlSchedule | deleteupdateview |
| data_source | update |
| gpt | deleteupdate |
| inbox | deleteupdate |
| Inbox.Inbox | createviewAny |
| interactivereply | deleteupdateview |
| label | deleteupdateview |
| Labels.Labels | createviewAny |
| Meta.Interactivereply | createviewAny |
| Meta.Whatsapptemplate | createviewAny |
| role | deleteupdateview |
| segment | deleteupdateview |
| sms_campaign | deleteupdateview |
| Spatie.Role | createviewAny |
| suggestion | deleteupdate |
| whatsapptemplate | deleteupdate |
28 gated models.
Example — forbidden
{
"message": "This action is unauthorized."
}