Rights and roles

Quiddly authorization is right-based. Every endpoint declares the rights it requires; tokens carry roles, and roles bundle rights.

• User-flow (HS256) tokens: rights resolve from the user’s roles in the finq_user model.
• Machine-flow (RS256) tokens: permissions come from Auth0 RBAC and arrive in the JWT’s permissions claim. The OAuth scope claim is not used for authorization.

If a request fails with 403 ACCESS_DENIED, the token is valid but missing the right the endpoint wants. The error message names the right.

Common rights for integrators

Right	Used for
ReadClients / CreateClients / UpdateClients	Client maintenance.
ReadDebtors / UpdateDebtors	Debtor maintenance.
ReadInvoices / CreateInvoices	Invoice flow.
CreateServiceAccount / GenerateTokenServiceAccount	Bootstrap your own credentials.
ReadPaymentMatchingEngine	Reconciliation.

The full list is large and tenant-specific. See the auto-generated Rights catalogue for every right Quiddly defines, grouped by domain, with the number of endpoints that require each one. The interactive reference also shows the required right on each endpoint.