Platform & Partners
Permission Reference
Complete list of permission keys available to platform admins and tenant users.
Permissions are dot-separated strings returned in permissions[] from GET /auth/me. Super admins receive a single * entry that passes all checks. All other roles receive an explicit list.
Permission checks in the frontend use two helpers:
hasPlatformPermission(permissions, key) for Platform Console gates and hasPermission(me, key) for workspace-level gates. Both handle the * wildcard.Platform admin permissions
| Permission key | Platform Console area | What it unlocks |
|---|---|---|
| platform:tenants:read | Tenants, Integrations | List and view all customer tenants; see tenant picker in integrations |
| platform:tenants:manage | Tenants, Integrations | Create / update customer tenants; provision API keys, webhooks, OAuth clients for them |
| platform:billing:read | Billing | View usage and billing info for the platform |
| platform:settings:read | Settings | View platform-level configuration |
| platform:settings:manage | Settings | Update platform-level configuration |
| platform:oauth_clients:read | OAuth Apps | List OAuth clients registered for the platform |
| platform:oauth_clients:manage | OAuth Apps | Create and manage OAuth clients |
| platform:users:manage | Users | Invite, update, and deactivate users within the platform |
| platform:interviews:rescore | Support | Trigger re-assessment on a completed interview |
| platform:impersonate | Support | Impersonate any user within the platform for debugging |
| apikey:read | Integrations → API Keys | List API keys for any customer tenant |
| apikey:create | Integrations → API Keys | Create API keys for any customer tenant |
| apikey:delete | Integrations → API Keys | Revoke API keys for any customer tenant |
| webhook:read | Integrations → Webhooks | Read webhook config for any customer tenant |
| webhook:update | Integrations → Webhooks | Upsert or delete webhook config for any customer tenant |
Tenant user permissions
Tenant users have workspace-scoped permissions. The exact set depends on their role within the workspace (admin, member, etc.). Common permissions:
| Permission key | Recruiter Console area | What it unlocks |
|---|---|---|
| interview:create | Jobs / A2A | Submit a new interview request |
| interview:read | Jobs, Assessment | View interview details, plan, and assessment |
| interview:approve | Plan review (HITL-1) | Approve or reject a generated plan |
| interview:update | Jobs | Update interview metadata |
| candidate:read | Candidates | View candidate profiles |
| recording:read | Assessment | Download or stream interview recordings |
| apikey:read | Integrations → API Keys | List workspace API keys |
| apikey:create | Integrations → API Keys | Create workspace API keys |
| apikey:delete | Integrations → API Keys | Revoke workspace API keys |
| webhook:read | Integrations → Webhooks | Read webhook config |
| webhook:update | Integrations → Webhooks | Upsert or delete webhook config |
Tenant users are never granted
platform:* permissions. Attempting to call a platform-admin endpoint with a tenant token returns 403 Forbidden.Backend enforcement
| Layer | Mechanism | Covers |
|---|---|---|
| Route guard | PermissionsGuard + PlatformGuard | Every admin endpoint — checks permission key and isPlatform flag |
| Cross-tenant check | assertAccess(actor, tenantId) | Verifies target tenant's parentPlatformId === actor.tenantId via Prisma lookup |
| Key embedding guard | ApiKeyController / ApiKeyAdminController | Rejects any platform:* permission in the requested key permissions list |
| Escalation guard | ApiKeyController (self-serve only) | Tenant user cannot grant a key more permissions than they hold |
Was this page helpful?