Company permissions
Users and groups share the permission names listed below. In user responses, named_permissions describes effective access, including group grants; own_named_permissions describes direct grants without groups. Both maps contain every name supported by the server, with false for ungranted rights. Company owners have all supported rights. Group responses contain the group's own grants.
The numeric permissions mask is also supported. GET user responses include group grants; PATCH user responses describe direct numeric permissions. Named-only rights have no numeric bit. A PATCH containing only the numeric mask preserves existing named-only grants such as mcpConnections.
Send one permission format per request. A named PATCH changes only supplied names; omitted names are preserved. False removes a direct or group grant, and does not override access the user receives through another group.
Known limitation: when both formats are supplied, group creation applies named entries to the supplied mask, while PATCH applies them to the stored permissions and ignores the supplied mask. The company-user PATCH response and audit log may nevertheless report the requested mask. Check own_named_permissions for stored direct grants.
Named permissions are an extensible map of names to boolean values: true grants access, false does not. For the numeric permissions mask, sum the bit values; a dash means that the right is available only by name. Unknown names with boolean values are ignored and grant no access. Older server versions may reject unknown names with HTTP 400. Non-boolean values are invalid.
| Name | Bit value | Access |
|---|---|---|
members | 1 | Administrative section "Members". Members management: permissions, invitations, deactivations. Permission to this section means user can change own permissions and get access to other administrative sections, including MCP connections. |
billing | 2 | Administrative section "Billing" |
properties | 4 | Administrative section "Company settings" |
entitiesTree | 16 | Administrative section "Entity Tree" |
cardTypes | 32 | Administrative section "Card types" |
timesheets | 64 | Administrative section "Timesheets" |
colleagueTimesheetAccess | 128 | Allow to read entries of colleagues in the card's Timesheets |
dump | 256 | Administrative sections "Import and export company data" |
tags | 512 | Administrative section "Tags" |
invite | 1024 | Allow to invite users into the company |
serviceDesk | 2048 | Settings sections of "Service Desk" |
customProperties | 4096 | Allow to create custom properties for cards |
cardShare | 8192 | Allow to open public access for cards (share the card) |
sdRequestAccess | 16384 | Allow to convert cards to service desk requests and changing the author |
activityLogs | 32768 | Administrative section "Activity Logs" |
resourcePlanning | 65536 | Resource planning |
calendars | 131072 | Administrative section "Calendars" |
serviceDeskAnalytics | 262144 | Analytics sections of "Service Desk" |
serviceDeskRequests | 524288 | Requests section of "Service Desk" |
addons | 1048576 | Administrative section "Addons" (on-premises); Manage addons in Developer Portal (cloud) |
auditLogs | 2097152 | Administrative section "Audit Logs" |
cardView | 4194304 | Administrative section "Card View" |
administrationResourcePlanning | 8388608 | Administrative section "Resource planning" |
membersWorkTimeSettings | 16777216 | Administrative section "Time Off Days" |
blockerCategories | 33554432 | Administrative section "Blocker Categories" |
netPromoterScore | 67108864 | Administrative section "Net Promoter Score" |
workflows | 134217728 | Administrative section "Workflows" |
adminStorageStats | 268435456 | Administrative section "Storage" |
aiAgents | 536870912 | Administrative section "AI Agents" |
externalWebhooks | 1073741824 | Administrative section "External webhooks" |
dashboardAdministration | – | Dashboard administration |
mcpConnections | – | Administrative section "MCP connections" |
