Roles and Privileges

This service is a Node.js / Fastify service. Authorization is expressed as privilege strings in preAuthorize("hasPrivilege('...')") or authHook('privilege', true). There is no roles_privileges.json — privileges are enforced from JWT claims provided by eq-authservices.

Why there is no Role → PrivilegeGroup mapping table: In Equinox 9.x, role definitions (which privileges belong to which role) are owned and managed entirely by eq-authservices. The eq-user-service only declares the privilege strings it requires at each endpoint and trusts the JWT claims it receives. To see which roles include a given privilege, query eq-authservices directly. The IamInvoker does create/delete IAM groups in the connector (e.g., Cognito groups) when role.created/role.deleted events arrive, but the privilege-to-role binding remains external.

Complete Privilege List

Privilege Scope Description
auth:deleteRole Internal Guard before role deletion — called by eq-authservices
user:assignRole Admin Replace user’s full role set
user:changePassword Self Change own password (IDP)
user:createAddress Admin Create address for a user
user:createAddressAction Self Create own address
user:createAttribute Admin Create custom attribute definition
user:createBlacklist Admin Add blacklist entry
user:createConsent Admin Create consent template
user:createInstance Admin Create tenant instance
user:createList Admin Create list for a user
user:createListAction Self Create own list
user:createListItem Admin Create list item
user:createListItemAction Self Create own list item
user:createNote Admin/CSR Create CSR note on user
user:createPaymentProfile Self/Admin Create payment profile
user:createSearchConfig Admin Create search configuration
user:createUserConsent Self/Admin Record user consent
user:deleteAddress Admin Delete user’s address
user:deleteAddressAction Self Delete own address
user:deleteAttribute Admin Delete attribute definition
user:deleteBlacklist Admin Remove blacklist entry
user:deleteConsent Admin Delete consent template
user:deleteInstance Admin Delete instance
user:deleteList Admin Delete list
user:deleteListAction Self Delete own list
user:deleteListItem Admin Delete list item
user:deleteListItemAction Self Delete own list item
user:deleteListItems Admin Batch delete list items
user:deleteNote Admin/CSR Delete CSR note
user:deletePaymentProfile Self/Admin Delete payment profile
user:deleteSearchConfig Admin Delete search configuration
user:deleteUser Admin Delete a user
user:deleteUserAction Self Delete own account
user:deleteUserConsent Self/Admin Revoke (soft-delete) a user consent
user:getActOnBehalfOfUrl CSR/Admin Generate act-on-behalf URL (CSR impersonation)
user:inviteUser Admin Invite new user with roles
user:listPaymentProfiles Self/Admin List payment profiles
user:logout Self Logout (invalidate all tokens)
user:manageStatus Admin Lifecycle actions on user (activate/deactivate/unlock/resend-invite/reset-password)
user:migrateLists Self/Admin Migrate guest lists to registered user
user:resendActivation Admin Resend activation/verification token
user:setupMfa Self Setup TOTP authenticator
user:setupSecurityQuestions Self Configure security questions
user:shareList Admin Share list via email
user:shareListAction Self Share own list via email
user:updateAddress Admin Update user’s address
user:updateAddressAction Self Update own address
user:updateAttribute Admin Update attribute definition
user:updateBlacklist Admin Update blacklist entry
user:updateConsent Admin Update consent template
user:updateInstance Admin Full update of instance
user:updateInstanceProperties Admin Partial update of instance properties
user:updateList Admin Update list
user:updateListAction Self Update own list
user:updateListItem Admin Update list item
user:updateListItemAction Self Update own list item
user:updateListItemProperties Admin Update list item properties
user:updateListProperties Admin Update list properties
user:updatePaymentProfile Self/Admin Update payment profile
user:updateSearchConfig Admin Update search configuration
user:updateUser Admin Update user profile
user:updateUserAction Self Update own profile
user:updateUserStatus Admin Activate/deactivate user
user:viewAddress Admin View user’s addresses
user:viewAddressAction Self View own addresses
user:viewAttribute Admin View attribute definitions
user:viewBlacklist Admin View blacklist entries
user:viewInstance Admin View instances / instance attributes
user:viewList Admin View user’s lists
user:viewListAction Self View own lists
user:viewListItem Admin View list items
user:viewListItemAction Self View own list items
user:viewMfa Self View TOTP status
user:viewNote Admin/CSR View user notes
user:viewPublic Public View public lists
user:viewSearchConfig Admin View search configurations
user:viewUserAction Self View own profile
user:viewUserConsent Self/Admin View user consent records
user:viewUserConsentHistory Self/Admin View user consent audit history
user:viewUserRoles Admin View user’s assigned roles
user:viewUsers Admin View users list

Revision History
2026-08-04 | JP – Created the page and added the content.