Restore a role's default access
Versioned reset to documented defaults; custom changes in other companies are untouched. Company permission: `resetCompanyRolePermissions`. Defaults: ADMIN. Current company role permissions and active membership are checked on every request; signed legacy role claims alone do not authorize this operation.
bearerAuthAuthorizationBearer <token>Obtained from POST /api/v1/auth/login, on the tenant's own subdomain. Presenting it on another tenant's subdomain is a 403.
code*stringapplication/json- body
lockVersion*integerint320 <= valueRole default permissions restored
*/*- response
code?stringdefaultPermissions?booleanid?stringuuidlockVersion?integerint32name?stringpermissions?array<string>curl -X POST 'https://api.monetaryai.uz/api/v1/settings/roles/string/permissions/reset' \ -H 'Content-Type: application/json' \ -d '{ "lockVersion": 0}'{ "code": "string", "defaultPermissions": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "lockVersion": 0, "name": "string", "permissions": [ "string" ]}Read one company user GET
Returns one visible membership with local display name, immutable login email, roles, status, last login and lockVersion. Company permission: `getCompanyUser`. Defaults: ADMIN. Current company role permissions and active membership are checked on every request; signed legacy role claims alone do not authorize this operation.
Replace a role's complete access list PUT
Send permission IDs from the catalogue and the last read lockVersion. An empty list denies all configurable APIs. Unknown/duplicate IDs are rejected. Changes apply to already-issued bearer tokens on their next request. The last permanent access administrator cannot be locked out; OWNER remains protected. Company permission: `replaceCompanyRolePermissions`. Defaults: ADMIN. Current company role permissions and active membership are checked on every request; signed legacy role claims alone do not authorize this operation.