Authorization API

Base URL: /api/v1/authorization

Manage roles, permissions, user role assignments, impersonation, role network rules, institution domains, dashboard tiles, and audit logging.

Endpoints Overview

Roles

Method	Endpoint	Description
GET	/roles	List roles
POST	/roles	Create role
GET	/roles/{roleID}	Get role details
PATCH	/roles/{roleID}	Update role
DELETE	/roles/{roleID}	Delete role
GET	/roles/{roleID}/permissions	Get permissions for role

Permission Nodes

Method	Endpoint	Description
GET	/permission-nodes/tree	Get permission tree hierarchy
GET	/permission-nodes	List permission nodes
POST	/permission-nodes	Create permission node
GET	/permission-nodes/{nodeID}	Get permission node details
PATCH	/permission-nodes/{nodeID}	Update permission node
DELETE	/permission-nodes/{nodeID}	Delete permission node

Role Permissions

Method	Endpoint	Description
POST	/role-permissions/bulk_assign	Bulk assign permissions to a role
POST	/role-permissions/bulk	Bulk create role permissions
GET	/role-permissions	List role permissions
POST	/role-permissions	Create role permission
GET	/role-permissions/{rpID}	Get role permission details
PATCH	/role-permissions/{rpID}	Update role permission
DELETE	/role-permissions/{rpID}	Delete role permission

User Roles

Method	Endpoint	Description
GET	/user-roles/my_roles	Get current user's roles
POST	/user-roles/switch_role	Switch active role
POST	/user-roles/derive_roles	Derive roles for a user
POST	/user-roles/derive_all_roles	Derive roles for all users
POST	/user-roles/start_impersonation	Start impersonating a user
POST	/user-roles/stop_impersonation	Stop impersonation
GET	/user-roles/current_impersonation	Get current impersonation state
GET	/user-roles/can_impersonate	Check if user can impersonate
GET	/user-roles	List user roles
POST	/user-roles	Assign role to user
GET	/user-roles/{urID}	Get user role details
PATCH	/user-roles/{urID}	Update user role
DELETE	/user-roles/{urID}	Delete user role

Role Networks

Gated on ADMIN.NETWORKS (migration 291).

Method	Endpoint	Description
GET	/networks	Networks, every role's rules, the enforcement mode and the caller's address
GET	/networks/test?address=	Which roles an address could use, and why
POST	/networks	Create a network
PUT	/networks/{networkID}	Replace a network and its ranges
DELETE	/networks/{networkID}	Delete a network no rule names
PUT	/roles/{roleID}/network-rules	Replace every network rule of one role

Role Networks

Which roles may be acted under from which source addresses (migration 291). For each role and address: a matching DENY network refuses, else a matching ALLOW network permits, else the role is refused — so a role with no ALLOW cannot be used from anywhere. Nothing is refused unless the server runs with ROLE_NETWORK_ENFORCEMENT=enforce. Every write takes effect on the next request. See Role Networks for the operator's view.

Get the Overview

GET /api/v1/authorization/networks

Success Response (200 OK)

{
  "networks": [
    {
      "network_id": 2,
      "name": "Campus 10.0.50.0/24",
      "is_active": true,
      "cidrs": [{ "network_cidr_id": 3, "cidr": "10.0.50.0/24" }],
      "rule_count": 9,
      "updated_at": "2026-10-26T12:00:00Z"
    }
  ],
  "rules": [{ "role_id": 2, "network_id": 2, "effect": "ALLOW" }],
  "mode": "log",
  "your_address": "10.0.50.17"
}

mode is the server's ROLE_NETWORK_ENFORCEMENT (off, log or enforce); your_address is the caller's source address as the server sees it.

Create or Replace a Network

POST /api/v1/authorization/networks
PUT  /api/v1/authorization/networks/{networkID}

Field	Type	Required	Description
name	string	Yes	Unique, up to 100 characters (409 on a duplicate)
description	string	No	Up to 500 characters
is_active	boolean	No	An inactive network matches nothing
cidrs	object[]	No	{ "cidr": "10.0.50.0/24", "description": "..." }. The complete set: a range left out is removed. A bare address is stored as a single host, and host bits are masked (10.0.50.7/24 becomes 10.0.50.0/24). An invalid or duplicate range is 400

DELETE /networks/{networkID} is refused with 409 while any role's rules still name the network.

Replace a Role's Rules

PUT /api/v1/authorization/roles/{roleID}/network-rules

{
  "rules": [
    { "network_id": 2, "effect": "ALLOW" },
    { "network_id": 5, "effect": "DENY" }
  ]
}

Replaces every rule of the role. A network may appear once (400 otherwise).

Success Response (200 OK)

{
  "role_id": 2,
  "rules": [
    { "role_id": 2, "network_id": 2, "effect": "ALLOW" },
    { "role_id": 2, "network_id": 5, "effect": "DENY" }
  ],
  "has_allow": true
}

has_allow: false is allowed but means nobody can act under the role from anywhere.

Test an Address

GET /api/v1/authorization/networks/test?address=203.0.113.9

Omit address to test the caller's own.

Success Response (200 OK)

{
  "address": "203.0.113.9",
  "mode": "log",
  "break_glass": false,
  "networks": ["Anywhere"],
  "roles": [
    { "role_id": 7, "role_code": "FACULTY", "name": "Faculty", "permitted": true, "reason": "ALLOW", "network": "Anywhere" },
    { "role_id": 2, "role_code": "REGISTRAR", "name": "Registrar", "permitted": false, "reason": "NO_ALLOW" }
  ]
}

reason is BREAK_GLASS (the address is in ROLE_NETWORK_BREAKGLASS_CIDRS), DENY, ALLOW or NO_ALLOW; network names the deciding network for DENY and ALLOW. The result is the rules' answer regardless of mode.

The network_role_denied error

When a request's address permits none of the user's roles, every route except GET /auth/me, POST /auth/logout and the stop/current-impersonation routes answers:

{
  "error": {
    "code": "network_role_denied",
    "message": "This role is not available from the network you are connecting from",
    "message_key": "errors.networkRoleDenied"
  }
}

with status 403. The same error refuses a sign-in and a role switch.

---

User Permissions & Menu

Method	Endpoint	Description
GET	/user-permissions	Get effective permissions for current user
GET	/user-menu	Get menu items for current user

Department Admins

Method	Endpoint	Description
Moved. Department administrators became unit administrators in July 2026 and live in
the Organization API at /organization/unit-administrators. They are
still gated on ADMIN.DEPT_ADMINS.

Institution Domains

Method	Endpoint	Description
GET	/domains	List institution domains
POST	/domains	Create institution domain
GET	/domains/{domainID}	Get domain details
PATCH	/domains/{domainID}	Update domain
DELETE	/domains/{domainID}	Delete domain
POST	/domains/check_email	Check email against institution domains

/institution-domains is the same resource under its full name. Reads need ADMIN.DOMAINS; create, update and delete also require an acting superuser (403 otherwise), whatever the grants say: the protected domains decide which email addresses are institutional, and so who can be linked to a login by SSO.

Dashboard Tiles

Method	Endpoint	Description
GET	/dashboard-tiles	List dashboard tiles
POST	/dashboard-tiles	Create dashboard tile
GET	/dashboard-tiles/{tileID}	Get dashboard tile details
PATCH	/dashboard-tiles/{tileID}	Update dashboard tile
DELETE	/dashboard-tiles/{tileID}	Delete dashboard tile

Role Default Tiles

Method	Endpoint	Description
GET	/role-default-tiles	List role default tiles
POST	/role-default-tiles	Create role default tile
GET	/role-default-tiles/{rdtID}	Get role default tile details
PATCH	/role-default-tiles/{rdtID}	Update role default tile
DELETE	/role-default-tiles/{rdtID}	Delete role default tile

Dashboard Preferences

Method	Endpoint	Description
GET	/dashboard-preferences/my_dashboard	Get current user's dashboard preferences
GET	/dashboard-preferences	List dashboard preferences
POST	/dashboard-preferences	Create dashboard preference
GET	/dashboard-preferences/{prefID}	Get dashboard preference details
PATCH	/dashboard-preferences/{prefID}	Update dashboard preference
DELETE	/dashboard-preferences/{prefID}	Delete dashboard preference

Audit Logs

Method	Endpoint	Description
GET	/audit-logs/by_entity	Get audit logs filtered by entity
GET	/audit-logs/recent	Get recent audit logs
GET	/audit-logs	List all audit logs
GET	/audit-logs/{logID}	Get audit log details

---

Roles

List Roles

GET /api/v1/authorization/roles

Get all authorization roles defined in the system.

Success Response (200 OK)

{
  "count": 5,
  "results": [
    {
      "role_id": 1,
      "role_code": "SUPER_ADMIN",
      "name": "Super Administrator",
      "description": "Full system access",
      "role_type": "SYSTEM",
      "is_active": true,
      "grants_superuser": true,
      "priority": 1,
      "session_timeout_minutes": null,
      "user_count": 3
    }
  ]
}

Field	Meaning
priority	Lower is higher. Picks a user's fallback acting role — when they have not chosen one, or when the chosen one is not usable from their network. New roles default to 100
session_timeout_minutes	The role's own idle-timeout limit, minimum 5; null uses the system value. It can only shorten a session. To remove a limit on update, send "clear_session_timeout": true

---

Get Role Permissions

GET /api/v1/authorization/roles/{roleID}/permissions

Get all permission nodes assigned to a specific role.

Path Parameters

Parameter	Type	Description
roleID	integer	Role ID

Success Response (200 OK)

{
  "success": true,
  "data": [
    {
      "permission_node_id": 10,
      "node_code": "academic.courses.view",
      "node_name": "View Courses",
      "parent_id": 5
    }
  ]
}

---

Permission Nodes

Get Permission Tree

GET /api/v1/authorization/permission-nodes/tree

Get the full permission tree hierarchy.

Success Response (200 OK)

{
  "success": true,
  "data": [
    {
      "permission_node_id": 1,
      "node_code": "academic",
      "node_name": "Academic",
      "node_type": "MODULE",
      "parent_id": null,
      "children": [
        {
          "permission_node_id": 5,
          "node_code": "academic.courses",
          "node_name": "Courses",
          "node_type": "FEATURE",
          "parent_id": 1,
          "children": [
            {
              "permission_node_id": 10,
              "node_code": "academic.courses.view",
              "node_name": "View Courses",
              "node_type": "ACTION",
              "parent_id": 5,
              "children": []
            }
          ]
        }
      ]
    }
  ]
}

---

List Permission Nodes

GET /api/v1/authorization/permission-nodes

Get a flat list of all permission nodes.

Success Response (200 OK)

{
  "count": 50,
  "results": [
    {
      "permission_node_id": 1,
      "node_code": "academic",
      "node_name": "Academic",
      "node_type": "MODULE",
      "parent_id": null,
      "is_active": true,
      "sort_order": 1
    }
  ]
}

---

Role Permissions

Bulk Assign Permissions

POST /api/v1/authorization/role-permissions/bulk_assign

Replace all permissions for a role with a new set of permission node IDs.

Request Body

Field	Type	Required	Description
role_id	integer	Yes	Role to assign permissions to
permission_node_ids	integer[]	Yes	Permission node IDs to assign

Example Request

curl -X POST http://localhost:8000/api/v1/authorization/role-permissions/bulk_assign \
  -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{
    "role_id": 2,
    "permission_node_ids": [10, 11, 12, 20, 21]
  }'

Success Response (200 OK)

{
  "success": true,
  "data": {
    "message": "Permissions updated",
    "assigned_count": 5
  }
}

---

Bulk Create Role Permissions

POST /api/v1/authorization/role-permissions/bulk

Create multiple role permission assignments at once.

Request Body

Field	Type	Required	Description
items	object[]	Yes	Array of role permission objects
items[].role_id	integer	Yes	Role ID
items[].permission_node_id	integer	Yes	Permission node ID

---

User Roles

Get My Roles

GET /api/v1/authorization/user-roles/my_roles

Get all roles assigned to the currently authenticated user.

Only roles inside their effective/expiration window are listed, so an expired role is never offered by the switcher. While impersonating, these are the impersonated user's roles.

Success Response (200 OK)

Abridged:

{
  "roles": [
    {
      "user_role_id": 1,
      "user_id": 12,
      "role_id": 2,
      "role_code": "REGISTRAR",
      "role_name": "Registrar",
      "is_manual_override": true,
      "available_from_network": false
    },
    {
      "user_role_id": 2,
      "user_id": 12,
      "role_id": 7,
      "role_code": "FACULTY",
      "role_name": "Faculty",
      "is_manual_override": false,
      "available_from_network": true
    }
  ],
  "active_role": { "role_id": 7, "role_code": "FACULTY", "name": "Faculty", "admin_id": null },
  "network_restricted_role": { "role_id": 2, "role_code": "REGISTRAR", "name": "Registrar" },
  "permissions": { "...": "..." },
  "menu_structure": [],
  "impersonation": null,
  "appointments": [],
  "active_appointment": null,
  "appointment_required": false,
  "appointment_role_ids": []
}

available_from_network is false for a role the request's source address may not act under (Role Networks). network_restricted_role is set when the user's chosen role is one of those: active_role is then the highest-priority role that is permitted, for this request only. The stored choice is not changed.

---

Switch Role

POST /api/v1/authorization/user-roles/switch_role

Switch the user's active role context.

Request Body

Field	Type	Required	Description
role_id	integer	Yes	Role ID to switch to

Example Request

curl -X POST http://localhost:8000/api/v1/authorization/user-roles/switch_role \
  -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{"role_id": 3}'

Success Response (200 OK)

{
  "role_id": 3,
  "role_code": "FACULTY",
  "name": "Faculty",
  "active_appointment": null
}

Switching to a role the request's source network may not use is refused with 403 network_role_denied. The acting role decides what every later request may do — the API, not only the menu — and the session's idle timeout follows it; re-read session_timeout_minutes from GET /auth/me after a switch.

---

Derive Roles

POST /api/v1/authorization/user-roles/derive_roles

Derive and assign roles for a specific user based on their relationships (student, teacher, advisor, etc.).

Request Body

Field	Type	Required	Description
user_id	integer	Yes	User ID to derive roles for

---

Derive All Roles

POST /api/v1/authorization/user-roles/derive_all_roles

Derive and assign roles for all users in the system. Admin only.

---

Start Impersonation

POST /api/v1/authorization/user-roles/start_impersonation

Start impersonating another user. Requires appropriate permissions.

Request Body

Field	Type	Required	Description
target_user_id	integer	Yes	User ID to impersonate

Example Request

curl -X POST http://localhost:8000/api/v1/authorization/user-roles/start_impersonation \
  -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{"target_user_id": 25}'

Success Response (200 OK)

{
  "success": true,
  "data": {
    "message": "Now impersonating user",
    "impersonated_user_id": 25,
    "impersonated_email": "student@university.edu",
    "tokens": {
      "access": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
      "refresh": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
    }
  }
}

---

Stop Impersonation

POST /api/v1/authorization/user-roles/stop_impersonation

Stop impersonating and return to original user context.

Success Response (200 OK)

{
  "success": true,
  "data": {
    "message": "Impersonation ended",
    "tokens": {
      "access": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
      "refresh": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
    }
  }
}

---

Get Current Impersonation

GET /api/v1/authorization/user-roles/current_impersonation

Get current impersonation state.

Success Response (200 OK)

{
  "success": true,
  "data": {
    "is_impersonating": true,
    "original_user_id": 1,
    "original_email": "admin@example.com",
    "impersonated_user_id": 25,
    "impersonated_email": "student@university.edu"
  }
}

---

Check Can Impersonate

GET /api/v1/authorization/user-roles/can_impersonate

Check if the current user has permission to impersonate others.

Success Response (200 OK)

{
  "success": true,
  "data": {
    "can_impersonate": true
  }
}

---

User Permissions & Menu

Get User Permissions

GET /api/v1/authorization/user-permissions

Get the effective permissions for the currently authenticated user based on their active role.

Success Response (200 OK)

{
  "success": true,
  "data": [
    {
      "node_code": "academic.courses.view",
      "node_name": "View Courses"
    },
    {
      "node_code": "academic.courses.edit",
      "node_name": "Edit Courses"
    }
  ]
}

---

Get User Menu

GET /api/v1/authorization/user-menu

Get the menu items available to the current user based on their permissions and active role.

Success Response (200 OK)

{
  "success": true,
  "data": [
    {
      "label": "Academic",
      "icon": "pi pi-book",
      "items": [
        {
          "label": "Courses",
          "to": "/academic/courses"
        },
        {
          "label": "Sections",
          "to": "/academic/sections"
        }
      ]
    }
  ]
}

---

Department Admins

Renamed and moved. The department_administrators table became unit_administrators in July 2026, keyed by org_unit_id and admin_level_id rather than department_id and a free-text level, and the endpoints moved to the Organization API:

Method	Endpoint
GET	/api/v1/organization/unit-administrators
POST	/api/v1/organization/unit-administrators
GET	/api/v1/organization/unit-administrators/{uaID}
PATCH	/api/v1/organization/unit-administrators/{uaID}
DELETE	/api/v1/organization/unit-administrators/{uaID}

Appointing or removing one re-derives that person's auto-assigned roles (ACADEMIC_ADMIN) immediately. See Organization.

---

Institution Domains

List Domains

GET /api/v1/authorization/domains

List institution email domains used for user classification.

Success Response (200 OK)

{
  "count": 2,
  "results": [
    {
      "domain_id": 1,
      "domain_name": "university.edu",
      "domain_type": "INSTITUTIONAL",
      "is_active": true,
      "created_at": "2024-01-01T00:00:00Z"
    }
  ]
}

---

Check Email Domain

POST /api/v1/authorization/domains/check_email

Check if an email address matches an institution domain.

Request Body

Field	Type	Required	Description
email	string	Yes	Email address to check

Example Request

curl -X POST http://localhost:8000/api/v1/authorization/domains/check_email \
  -b cookies.txt \
  -H "Content-Type: application/json" \
  -d '{"email": "john@university.edu"}'

Success Response (200 OK)

{
  "success": true,
  "data": {
    "is_institutional": true,
    "domain": "university.edu",
    "domain_type": "INSTITUTIONAL"
  }
}

---

Dashboard Tiles

List Dashboard Tiles

GET /api/v1/authorization/dashboard-tiles

List all available dashboard tiles.

Success Response (200 OK)

{
  "count": 8,
  "results": [
    {
      "tile_id": 1,
      "tile_code": "MY_SCHEDULE",
      "title": "My Schedule",
      "description": "View your current class schedule",
      "component_name": "ScheduleTile",
      "icon": "pi pi-calendar",
      "default_width": 2,
      "default_height": 1,
      "is_active": true
    }
  ]
}

---

Role Default Tiles

List Role Default Tiles

GET /api/v1/authorization/role-default-tiles

List default dashboard tile configurations per role.

Success Response (200 OK)

{
  "count": 3,
  "results": [
    {
      "role_default_tile_id": 1,
      "role_id": 3,
      "role_name": "Student",
      "tile_id": 1,
      "tile_code": "MY_SCHEDULE",
      "tile_title": "My Schedule",
      "position": 1,
      "width": 2,
      "height": 1
    }
  ]
}

---

Create Role Default Tile

POST /api/v1/authorization/role-default-tiles

Request Body

Field	Type	Required	Description
role_id	integer	Yes	Role ID
tile_id	integer	Yes	Dashboard tile ID
position	integer	No	Display position
width	integer	No	Tile width (grid units)
height	integer	No	Tile height (grid units)

---

Dashboard Preferences

Get My Dashboard

GET /api/v1/authorization/dashboard-preferences/my_dashboard

Get the current user's personalized dashboard tile preferences.

Success Response (200 OK)

{
  "success": true,
  "data": [
    {
      "preference_id": 1,
      "tile_id": 1,
      "tile_code": "MY_SCHEDULE",
      "title": "My Schedule",
      "component_name": "ScheduleTile",
      "position": 1,
      "width": 2,
      "height": 1,
      "is_visible": true
    }
  ]
}

---

Create Dashboard Preference

POST /api/v1/authorization/dashboard-preferences

Request Body

Field	Type	Required	Description
tile_id	integer	Yes	Dashboard tile ID
position	integer	No	Display position
width	integer	No	Tile width
height	integer	No	Tile height
is_visible	boolean	No	Whether tile is visible (default: true)

---

Audit Logs

Get Logs by Entity

GET /api/v1/authorization/audit-logs/by_entity

Get audit logs filtered by entity type and ID.

Query Parameters

Parameter	Type	Description
entity_type	string	Entity type (e.g., student, course, person)
entity_id	string	Entity ID

Example Request

curl -X GET "http://localhost:8000/api/v1/authorization/audit-logs/by_entity?entity_type=student&entity_id=1001" \
  -b cookies.txt

Success Response (200 OK)

{
  "count": 15,
  "results": [
    {
      "log_id": 500,
      "user_id": 1,
      "user_email": "admin@example.com",
      "action": "UPDATE",
      "entity_type": "student",
      "entity_id": "1001",
      "changes": {
        "student_status_id": {"old": 1, "new": 2}
      },
      "ip_address": "192.168.1.100",
      "created_at": "2024-06-15T10:30:00Z"
    }
  ]
}

---

Get Recent Logs

GET /api/v1/authorization/audit-logs/recent

Get the most recent audit log entries across the system.

Query Parameters

Parameter	Type	Description
limit	integer	Number of entries to return (default: 50)

---

List Audit Logs

GET /api/v1/authorization/audit-logs

List all audit log entries with pagination.

Query Parameters

Parameter	Type	Description
user_id	integer	Filter by user
action	string	Filter by action (CREATE, UPDATE, DELETE)
entity_type	string	Filter by entity type
ordering	string	Sort by: created_at

---

Get Audit Log Details

GET /api/v1/authorization/audit-logs/{logID}

Get full details of a specific audit log entry.

Path Parameters

Parameter	Type	Description
logID	integer	Audit log ID

---

---

---

Complete endpoint reference

Every route this domain registers, with the permission node that gates it. Generated from the route table, so it is complete by construction — the sections above explain behaviour, this one guarantees nothing is missing.

Paths are relative to /api/v1/authorization. A node in italics is an exemption rather than a grant: selfservice acts only on the caller's own record, public needs no session at all, and custom carries its own wrapper.

Method	Endpoint	Permission node	Description
GET	/audit-log	ADMIN.AUDIT	Get audit log
GET	/audit-log/{logID}	ADMIN.AUDIT	Get one audit log
GET	/audit-logs	ADMIN.AUDIT	List audit logs
GET	/audit-logs/by_entity	ADMIN.AUDIT	Get by entity
GET	/audit-logs/recent	ADMIN.AUDIT	Get recent
GET	/audit-logs/{logID}	ADMIN.AUDIT	Get one audit log
GET	/dashboard-preferences	selfservice	List dashboard preferences
POST	/dashboard-preferences	selfservice	Create a dashboard preference
GET	/dashboard-preferences/my_dashboard	selfservice	Get my dashboard
DELETE	/dashboard-preferences/{prefID}	selfservice	Delete a dashboard preference
GET	/dashboard-preferences/{prefID}	selfservice	Get one dashboard preference
PATCH	/dashboard-preferences/{prefID}	selfservice	Update a dashboard preference
GET	/dashboard-tiles	ADMIN.SYSTEM_SETTINGS	List dashboard tiles
POST	/dashboard-tiles	ADMIN.SYSTEM_SETTINGS	Create a dashboard tile
DELETE	/dashboard-tiles/{tileID}	ADMIN.SYSTEM_SETTINGS	Delete a dashboard tile
GET	/dashboard-tiles/{tileID}	ADMIN.SYSTEM_SETTINGS	Get one dashboard tile
PATCH	/dashboard-tiles/{tileID}	ADMIN.SYSTEM_SETTINGS	Update a dashboard tile
GET	/domains	ADMIN.DOMAINS	List domains
POST	/domains	ADMIN.DOMAINS	Create a domain
POST	/domains/check_email	selfservice	Check email
DELETE	/domains/{domainID}	ADMIN.DOMAINS	Delete a domain
GET	/domains/{domainID}	ADMIN.DOMAINS	Get one domain
PATCH	/domains/{domainID}	ADMIN.DOMAINS	Update a domain
GET	/impersonation/active	selfservice	Get active
POST	/impersonation/start	IMPERSONATE_USERS	Start
POST	/impersonation/stop	selfservice	Stop
GET	/institution-domains	ADMIN.DOMAINS	List institution domains
POST	/institution-domains	ADMIN.DOMAINS	Create a institution domain
DELETE	/institution-domains/{domainID}	ADMIN.DOMAINS	Delete a institution domain
GET	/institution-domains/{domainID}	ADMIN.DOMAINS	Get one institution domain
PATCH	/institution-domains/{domainID}	ADMIN.DOMAINS	Update a institution domain
POST	/invalidate-cache	ADMIN.PERMISSIONS	Create invalidate cache
GET	/my-shortcuts	selfservice	List my shortcuts
POST	/my-shortcuts	selfservice	Create a my shortcut
PUT	/my-shortcuts/reorder	selfservice	Reorder
DELETE	/my-shortcuts/{shortcutID}	selfservice	Delete a my shortcut
PATCH	/my-shortcuts/{shortcutID}	selfservice	Rename a my shortcut
GET	/networks	ADMIN.NETWORKS	Get the role network overview
POST	/networks	ADMIN.NETWORKS	Create a network
GET	/networks/test	ADMIN.NETWORKS	Test an address
DELETE	/networks/{networkID}	ADMIN.NETWORKS	Delete a network
PUT	/networks/{networkID}	ADMIN.NETWORKS	Replace a network
GET	/permission-nodes	ADMIN.PERMISSIONS	List permission nodes
POST	/permission-nodes	ADMIN.PERMISSIONS	Create a permission node
GET	/permission-nodes/tree	ADMIN.PERMISSIONS	Get tree
DELETE	/permission-nodes/{nodeID}	ADMIN.PERMISSIONS	Delete a permission node
GET	/permission-nodes/{nodeID}	ADMIN.PERMISSIONS	Get one permission node
PATCH	/permission-nodes/{nodeID}	ADMIN.PERMISSIONS	Update a permission node
GET	/permission-nodes/{nodeID}/holders	ADMIN.PERMISSIONS	List the permission node's holders
GET	/permissions/export	ADMIN.PERMISSIONS.TRANSFER	Export a permission bundle
POST	/permissions/import/apply	ADMIN.PERMISSIONS.TRANSFER	Apply a bundle (also requires superuser)
POST	/permissions/import/preview	ADMIN.PERMISSIONS.TRANSFER	Preview a bundle
GET	/role-default-tiles	ADMIN.ROLES	List role default tiles
POST	/role-default-tiles	ADMIN.ROLES	Create a role default tile
DELETE	/role-default-tiles/{rdtID}	ADMIN.ROLES	Delete a role default tile
GET	/role-default-tiles/{rdtID}	ADMIN.ROLES	Get one role default tile
PATCH	/role-default-tiles/{rdtID}	ADMIN.ROLES	Update a role default tile
GET	/role-permissions	ADMIN.PERMISSIONS	List role permissions
POST	/role-permissions	ADMIN.PERMISSIONS	Create a role permission
POST	/role-permissions/bulk	ADMIN.PERMISSIONS	Create bulk
POST	/role-permissions/bulk_assign	ADMIN.PERMISSIONS	Bulk assign
DELETE	/role-permissions/{rpID}	ADMIN.PERMISSIONS	Delete a role permission
GET	/role-permissions/{rpID}	ADMIN.PERMISSIONS	Get one role permission
PATCH	/role-permissions/{rpID}	ADMIN.PERMISSIONS	Update a role permission
GET	/roles	ADMIN.ROLES	List roles
POST	/roles	ADMIN.ROLES	Create a role
DELETE	/roles/{roleID}	ADMIN.ROLES	Delete a role
GET	/roles/{roleID}	ADMIN.ROLES	Get one role
PATCH	/roles/{roleID}	ADMIN.ROLES	Update a role
GET	/roles/{roleID}/menu-shortcuts	ADMIN.ROLES	List the role's menu shortcuts
PUT	/roles/{roleID}/menu-shortcuts	ADMIN.ROLES	Update the role's menu shortcuts
PUT	/roles/{roleID}/network-rules	ADMIN.NETWORKS	Replace the role's network rules
DELETE	/roles/{roleID}/permissions	ADMIN.PERMISSIONS	Clear the role's permissions
GET	/roles/{roleID}/permissions	ADMIN.ROLES	List the role's permissions
POST	/switch-role	selfservice	Switch role
GET	/user-dashboard-preferences	selfservice	List user dashboard preferences
POST	/user-dashboard-preferences	selfservice	Create a user dashboard preference
DELETE	/user-dashboard-preferences/{prefID}	selfservice	Delete a user dashboard preference
GET	/user-dashboard-preferences/{prefID}	selfservice	Get one user dashboard preference
PATCH	/user-dashboard-preferences/{prefID}	selfservice	Update a user dashboard preference
GET	/user-menu	selfservice	Get user menu
GET	/user-permissions	selfservice	List user permissions
GET	/user-roles	ADMIN.USER_ROLES	List user roles
POST	/user-roles	ADMIN.USER_ROLES	Create a user role
GET	/user-roles/assignable_users	ADMIN.USER_ROLES	List assignable users
GET	/user-roles/can_impersonate	IMPERSONATE_USERS	Get can impersonate
GET	/user-roles/current_impersonation	selfservice	Get current impersonation
POST	/user-roles/derive_all_roles	ADMIN.USER_ROLES	Derive all roles
POST	/user-roles/derive_roles	selfservice	Derive roles
GET	/user-roles/my_roles	selfservice	List the caller's roles
POST	/user-roles/start_impersonation	IMPERSONATE_USERS	Start impersonation
POST	/user-roles/stop_impersonation	selfservice	Stop impersonation
POST	/user-roles/switch_role	selfservice	Switch role
DELETE	/user-roles/{urID}	ADMIN.USER_ROLES	Delete a user role
GET	/user-roles/{urID}	ADMIN.USER_ROLES	Get one user role
PATCH	/user-roles/{urID}	ADMIN.USER_ROLES	Update a user role