Permissions

Permissions decide what the public, platform roles, and website user roles can do on an object type’s entries. Role checkboxes are RBAC (own vs others). Optional structured conditions on a grant further restrict matches (field compare or a time window such as younger than 30 minutes since created_at). Empty conditions keep the checkbox-only behavior. GET list and GET detail enforce the same helper as the admin UI. Public create and view_all apply only to an anonymous visitor. A signed-in visitor is checked only against their website user role. Public grants are not added. Create requires that role's mutate_own on the type. Read requires see_own or see_others. A role map that lists any type and omits another type denies the omitted type. An empty object_types map is the legacy allow for create, read, and update. Registration assigns a role: the user-type role field default, otherwise the role labeled user, otherwise the oldest role. assign_user_role only changes that role. see_own means created_by_website_user_id equals the signed-in website user id. Self-registration sets that column, so the linked profile is own.

Read the current permission matrix.

GET /api/v1/{locale}/{websiteId}/objects/{objectTypeId}/permissions

Replace permissions. Role slices typically require website superadmin.

PUT /api/v1/{locale}/{websiteId}/objects/{objectTypeId}/permissions

{
  "public": {},
  "platformRoles": [{ "id": "string", "objectType": {} }],
  "websiteUserRoles": [{ "id": "string", "objectType": {} }]
}

MCP: get_object_permissions, save_object_permissions.