Roles and Privileges

  • Enforcement: each protected route runs an auth hook that checks the caller’s privilege and, because admin is required on every route, also requires the caller to be an admin. On failure it returns AUTH_INSUFFICIENT_PERMISSIONS (HTTP 403).
  • Authentication: JWT Bearer validated against AWS Cognito. Missing/invalid tokens map to EQ-USR-401xxxx codes.
  • Namespace: all privileges are in the subscription: namespace.

Full privilege list (all in the subscription: namespace):

Group Privileges
Core create, view, list, update, cancel, delete, manage, count
Pause pause, resume, pauseExtend, viewPauseHistory, viewPauseStatus, checkPauseEligibility
Instances (orders) viewInstances, viewInstance, viewScheduledInstances, retryInstance, skipInstance, processInstance
Tenant instances createInstance, updateInstance, updateInstanceProperties, deleteInstance
Items & control addItems, updateItem, removeItems, skipItem, bulkSkipItems, skipNextOrder, updateInterval, viewSummary
Bulk bulkUpdate, bulkDelete, bulkInstanceAction, createTransaction
Instance attributes viewInstanceAttribute, createInstanceAttribute, updateInstanceAttribute, deleteInstanceAttribute
User preferences createUserPreference, viewUserPreference, viewAllUserPreferences, updateUserPreference, deleteUserPreference

Public / unauthenticated routes (no auth hook): GET /v1/subscriptions/firstDeliveryDate, GET /v1/subscriptions/gift/:redemptionCode, GET /v1/subscriptions/prepaid-plans, plus /v1/health and /v1/cors-test. (The swap-recommendations route is not implemented — see §3.8.)

Revision History
2026-08-05 | JP – Created the page and added the content.