Security

Manage roles and permissions for role-based access control (RBAC).

All endpoints require Authorization: Bearer <token>.

---

Permissions

List All Permissions

GET /permissions

Returns all available permissions.

Example

curl -X GET https://api.vanillatots.com/permissions \
  -H "Authorization: Bearer $TOKEN"

Response 200 OK

[
  {
    "id": "uuid",
    "section": "students",
    "access": "read"
  }
]

Create Permission

POST /permissions

Define a new permission.

Request Body

Field	Type	Required	Description
section	string	Yes	Feature section (e.g., "students", "employees")
access	string	Yes	Access level (e.g., "read", "write", "delete")

Response 200 OK — Returns the created PermissionResponse.

---

Roles

List All Roles

GET /roles

Returns all defined roles with their attached permissions.

Example

curl -X GET https://api.vanillatots.com/roles \
  -H "Authorization: Bearer $TOKEN"

Response 200 OK

[
  {
    "id": "uuid",
    "name": "Admin",
    "avatarNumber": 1,
    "permissions": [
      { "id": "uuid", "section": "students", "access": "read" }
    ]
  }
]

Create Role

POST /roles

Create a new role.

Request Body

Field	Type	Required	Description
name	string	Yes	Role name (e.g., "Teacher", "Admin")
avatar	integer	Yes	Avatar icon number

Response 200 OK — Returns the created RoleResponse.

Get Role

GET /roles/{id}

Retrieve a single role by ID.

Path Parameters

Parameter	Type	Description
id	uuid	Role ID

Response 200 OK — Returns a RoleResponse with attached permissions.

Attach Permissions to Role

PATCH /roles/{id}/permissions

Update the permissions attached to a role.

Path Parameters

Parameter	Type	Description
id	uuid	Role ID

Request Body

Field	Type	Required	Description
permissionIds	string[]	Yes	Array of permission IDs to attach

Example

curl -X PATCH https://api.vanillatots.com/roles/{id}/permissions \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "permissionIds": ["perm-uuid-1", "perm-uuid-2"]
  }'

Response 200 OK — Returns the updated RoleResponse with permissions.