How Access Works
How an organization, its members, roles, permissions, environments and API keys fit together, and which endpoints manage each.
Everything in MindCloud belongs to an organization (a company). Workflows, connections, Analytics pages and API keys all live in one organization, and every request acts in one. Organizations explains which organizations a key can reach and how to pick one with X-Company-Id.
Members and roles
People belong to an organization as members, and each member has one role. A role is a set of permissions, such as workflow:edit or member:create. MindCloud's built-in roles (Owner, Admin, Manager, Developer, Member and Viewer, among others) come with fixed permissions; a custom role holds exactly the permissions you give it.
- List Members and Update Member read and change members and their roles.
- Create Invitation invites someone by email with a role; they become a member when they accept.
- List Roles, Create Role and List Permissions manage roles and show every permission a role can hold.
- Get Member Permissions shows what one member can do and why, and Check Authorization answers whether they can do one thing before they try.
API keys
An API key belongs to the member who created it and acts as that person. A key holds its own set of permissions, and uses one only while its creator holds it too, so a key is never stronger than the person behind it. Authentication lists every permission and what it allows.
- Who Am I? answers the organization a call acts in and what the key can do there.
- Create API Key, Update API Key and Revoke API Key manage keys.
- List Audit Events shows what keys changed, and what they were refused.
The organization itself
- Get Company and Update Company read and change the organization's profile.
- Environments, such as Production and Sandbox, let one workflow run against different connections: List Environments.
- An organization can manage others as its child organizations: Child Organizations explains how, and one key can then act in each child.
Product-specific access
Each product adds its own layer on top of roles:
- Cirra decides, per role, which apps, models and actions Cirra may use, and who may use each shared connection and how far (its share list of Everyone, roles and teams): Get Role Capabilities and Get Connection Shares. Teams group members across roles: List Teams.
- Cirra Analytics adds page sharing and seats on top of roles: Analytics.