Skip to main content

Authorization

Numeraire SwissKnife combines account ownership with scoped administrative permissions.

  • /v1/me routes are scoped to the authenticated account and, where applicable, an owned wallet ID in the path. They do not require administrative permission scopes.
  • Non-/me routes check the permission required for the operation.

Permissions​

Permissions are a list of strings such as read:account, write:account, read:wallet, and write:transaction.

  • For OAuth2/OIDC, the external identity provider adds the effective permissions to the token. Token claims are authoritative and cannot be replaced through the account API.
  • For local JWT, permissions are stored on the account. The initial account receives all permissions, and an admin can replace another local account's grants through PUT /v1/accounts/{id}/permissions.
  • API keys always retain the account-scoped /v1/me baseline. Their stored permission subset adds administrative routes and can be revoked independently.

Example​

{
  "sub": "1234567890",
  "permissions": ["read:transaction"]
}

In this example, the caller can read invoices and payments.

To see the permissions required for each endpoint, check the API documentation.