Roles and Privileges
Authentication is JWT bearer (AWS Cognito). Authorization is a thin per-route check: every business route declares a required privilege, and the authorization hook validates the token, confirms the privilege is present in the token’s privilege claim, and — for admin routes — additionally requires the caller to be an admin. If the caller lacks the privilege (or admin status where required), the request is rejected with a 403 insufficient-permissions error.
- Cart Actions and the carts list require a privilege only.
- All instance, instance-attribute, service-registry, and workflow routes additionally require admin.
- The token’s privilege, roles, and username claim names are configurable.
Full privilege list (37, all cart: prefixed):
cart:addItems, cart:updateQuantity, cart:updateShipping, cart:updatePayment, cart:applyPromocode, cart:viewCart, cart:viewMiniCart, cart:reviewOrder, cart:placeOrder, cart:deleteCart, cart:mergeCarts, cart:deleteItems, cart:deletePayment, cart:updateItemAddresses, cart:updateCommunicationPreferences, cart:virtualCart, cart:virtualCartCheckout, cart:viewCarts, cart:viewInstance, cart:createInstance, cart:updateInstance, cart:updateInstanceProperties, cart:deleteInstance, cart:viewInstanceAttribute, cart:viewServiceRegistry, cart:createServiceRegistry, cart:updateServiceRegistry, cart:deleteServiceRegistry, cart:viewWorkflows, cart:viewWorkflow, cart:createWorkflow, cart:updateWorkflow, cart:validateWorkflow, cart:deleteWorkflow, cart:viewResolvedWorkflow, cart:viewWorkflowChannels, cart:viewWorkflowActions.
Marketplace routes carry their own privilege strings owned by the marketplace integration capability; they are not enumerated here.
Revision History
2026-08-05 | AN – Page created and uploaded the contents