Roles and Privileges

Enforcement model:

  1. Every protected route is guarded by a privilege check.
  2. The check verifies the caller’s JWT carries the required privilege.
  3. If requireAdmin is true, the caller must additionally be an admin.
  4. On failure it returns AUTH_INSUFFICIENT_PERMISSIONS (EQ-PROMO-4030001, HTTP 403).
  5. Bypasses (flag): if the auth plugin is not registered (in-memory mode) or PROMO_SKIP_AUTH=true, the check is skipped — no auth enforced.

All privileges use the promotion: namespace. Full list discovered from route registrations:

Domain Privileges
Promotions createPromotion, viewPromotion, updatePromotion, deletePromotion, duplicatePromotion, viewLivePromotion, previewPromotion, evaluatePromotion
Groups createGroup, viewGroup, viewLiveGroup, updateGroup, deleteGroup, cloneGroup, viewGroupMembers, assignGroupMembers, unassignGroupMember
Displays createDisplay, viewDisplay, createDisplayItem, deleteDisplayItem
Lists createPromotionList, viewPromotionList, updatePromotionList, deletePromotionList, createPromotionListItem, deletePromotionListItem, viewPromotionListItems
Wallet viewWallet, viewVisibleWallet, grantWalletEntry, revokeWalletEntry
Promocodes createPromocodeList, viewPromocodeList, updatePromocodeList, viewPromocode, exportPromocode, bulkAssignPromocode, validatePromocode, redeemPromocode, blockPromocode, unblockPromocode, assignPromocode, unassignPromocode, reversePromocode, viewPromocodeUsageCount
Instances createInstance, viewInstance, updateInstance, deleteInstance
Instance Attributes viewInstanceAttribute
Workflow applyWorkflow, viewWorkflow
Audit viewAudit
Versions view, update (note: bare promotion:view / promotion:update)

Workflow permissions — the workflow config references wildcard permission patterns on transitions: promotion:create*, promotion:update*, promotion:approve*. These gate individual workflow actions (CREATE_DRAFT, UPDATE_DRAFT, APPROVE, DENY, etc.).

Revision History
2026-08-05 | JP – Created the page and added the content.