Marvia API uses permission-scoped API keys to securely control access to its features. Each API key can be assigned specific permissions for different entities (e.g., Locations, Users, Groups). These permissions determine which actions are allowed when using the key.Why Permissions Matter#
Having granular permissions helps to:Enforce the principle of least privilege
Protect sensitive operations like user management
Limit the damage if an API key is ever exposed
{
"error": {
"code": "UNAUTHORIZED",
"message": "Missing permission: read:locations"
}
}
<action>:<entity>read:locations → Read Locations (List or Get details)
create:users → Create Users
update:groups → Update Groups
delete:locations → Delete Locations
| HTTP Method | Action | Required Permission |
|---|
GET | Read data | read:<entity> |
POST | Create data | create:<entity> |
PUT/PATCH | Update data | update:<entity> |
DELETE | Delete data | delete:<entity> |
Example: List Locations#
Required Permission: read:locationsEditing Permissions#
To modify permissions for an existing key:1.
Go to Settings → Connections → Marvia API
2.
Locate the relevant API key
4.
Add or remove permissions as needed
6.
View permissions applied to confirm (optional)
Modified at 2025-07-14 13:19:25
