Rights and roles
Quiddly authorization is right-based. Every endpoint declares the rights it requires; tokens carry roles, and roles bundle rights.
- User-flow (HS256) tokens: rights resolve from the user’s roles in the
finq_usermodel. - Machine-flow (RS256) tokens: permissions come from Auth0 RBAC and
arrive in the JWT’s
permissionsclaim. The OAuthscopeclaim is not used for authorization.
If a request fails with 403 ACCESS_DENIED, the token is valid but
missing the right the endpoint wants. The error message names the right.
Common rights for integrators
Section titled “Common rights for integrators”| Right | Used for |
|---|---|
ReadClients / CreateClients / UpdateClients |
Client maintenance. |
ReadDebtors / UpdateDebtors |
Debtor maintenance. |
ReadInvoices / CreateInvoices |
Invoice flow. |
CreateServiceAccount / GenerateTokenServiceAccount |
Bootstrap your own credentials. |
ReadPaymentMatchingEngine |
Reconciliation. |
The full list is large and tenant-specific. See the auto-generated Rights catalogue for every right Quiddly defines, grouped by domain, with the number of endpoints that require each one. The interactive reference also shows the required right on each endpoint.