Create Permission

This API creates a new permission set within the tenant. A permission set defines the actions a user is allowed to perform across the different modules of the system, and can be assigned to users with the member role within a group.

Endpoint Details

URL	/v1/auth/permissions
Method	POST
Authorization	Bearer Token

---

Request Headers

Header	Type	Description
Content-Type	String	Must be application/json

---

Request Body

Use the following format to make a request:

JSON Request

{
  "name": "security config only",
  "description": "",
  "data": {
    "access_token": {
      "read": false,
      "create": false,
      "update": false,
      "regenerate_token": false
    },
    "encryption": {
      "read": true,
      "create": true,
      "update": true,
      "rotation_key": true,
      "list_rotation_key": true,
      "delete_rotation_key": false,
      "encrypt": true,
      "decrypt": true
    },
    "tokenization": {
      "read": true,
      "create": true,
      "update": true,
      "tokenize": true,
      "detokenize": true
    },
    "masking": {
      "read": true,
      "create": true,
      "update": true,
      "masking": true
    },
    "group": {
      "read": false,
      "invite_member": false,
      "remove_member": false
    },
    "audit": {
      "read": false,
      "export": false
    },
    "backup_restore": {
      "read": false,
      "manual_backup": false,
      "automatic_backup": false,
      "restore": false,
      "download": false,
      "delete": false
    },
    "license": {
      "read": false,
      "update": false
    },
    "taka_lock": {
      "lock": false
    },
    "syslog_log_integration": {
      "read": false,
      "sync": false,
      "update": false,
      "test_connection": false
    },
    "splunk_log_integration": {
      "read": false,
      "sync": false,
      "update": false,
      "test_connection": false
    },
    "loki_log_integration": {
      "read": false,
      "sync": false,
      "update": false,
      "test_connection": false
    },
    "decrypt_client": {
      "read": false,
      "delete": false,
      "create_encryption": false,
      "create_tokenization": false
    },
    "notification": {
      "backup_recovery": false,
      "compliance_audit_trail": false,
      "integration_api_activity": false,
      "key_lifecycle_management": false,
      "network_connectivity": false,
      "operational_maintenance": false,
      "security_access_control": false,
      "system_health_performance": false,
      "user_role_management": false
    }
  }
}

---

Parameters

Parameter	Type	Description
name	String	Name of the permission set
description	String	Optional description of the permission set
data	Object	Object mapping each module to its available actions

Permission Modules and Actions

Each key within data represents a module, and its value is an object that contains actions with boolean values. Use true to grant permission and false to deny permission:

Module	Available actions
access_token	read, create, update, regenerate_token
encryption	read, create, update, rotation_key, list_rotation_key, delete_rotation_key, encrypt, decrypt
tokenization	read, create, update, tokenize, detokenize
masking	read, create, update, masking
group	read, invite_member, remove_member
audit	read, export
backup_restore	read, manual_backup, automatic_backup, restore, download, delete
license	read, update
taka_lock	lock
syslog_log_integration	read, sync, update, test_connection
splunk_log_integration	read, sync, update, test_connection
loki_log_integration	read, sync, update, test_connection
decrypt_client	read, delete, create_encryption, create_tokenization
notification	backup_recovery, compliance_audit_trail, integration_api_activity, key_lifecycle_management, network_connectivity, operational_maintenance, security_access_control, system_health_performance, user_role_management

---

Response

Here is an example response after the request has been successfully processed:

Response

{
    "permission": {
        "id": "2be1c503-5dd1-4eb0-91c7-36926d81b09e",
        "tenant_id": "5ebde17c-01a1-4394-977b-9e611250cf5d",
        "name": "Security Config Only",
        "data": {
            "encryption": {
                "read": true,
                "create": true,
                "update": true,
                "rotation_key": true,
                "list_rotation_key": true,
                "encrypt": true,
                "decrypt": true
            },
            "tokenization": {
                "read": true,
                "create": true,
                "update": true,
                "tokenize": true,
                "detokenize": true
            },
            "masking": {
                "read": true,
                "create": true,
                "update": true,
                "masking": true
            },
            "access_token": {},
            "group": {},
            "users": {},
            "audit": {},
            "backup_restore": {},
            "license": {},
            "taka_lock": {},
            "decrypt_client": {},
            "syslog_log_integration": {},
            "splunk_log_integration": {},
            "loki_log_integration": {},
            "notification": {}
        },
        "created_by": "0a937c60-0ed4-4d06-870a-2e284b54287d",
        "updated_by": "0a937c60-0ed4-4d06-870a-2e284b54287d",
        "created_at": 1784102813,
        "updated_at": 1784102813
    }
}

---

Field Descriptions

Field	Type	Description
id	UUID	Unique identifier of the permission set
tenant_id	UUID	Identifier of the tenant that owns the permission set
name	String	Name of the permission set
data	Object	Object mapping each module to the actions granted by this permission
created_by	UUID	Identifier of the user who created the permission set
updated_by	UUID	Identifier of the user who last updated the permission set
created_at	Integer	Creation timestamp in Unix format
updated_at	Integer	Last update timestamp in Unix format

---

info

• A valid Bearer Token is required to access this endpoint.
• In the response, only granted (true) actions are returned. Modules with no granted actions are returned as an empty object {}.
• Unix timestamp fields can be converted to a human-readable date and time format as needed.