Role-based access control and temporary, time-limited permission grants for Classic API users and organizations.
Manage access control and permissions for your Amigo implementation.
Classic API. These role-based permissions apply to Classic API users and organizations. The Platform API uses workspace-scoped API keys for authentication. See Platform API Authentication.
Predefined sets of permissions. Each new organization is seeded with four default roles: DefaultUserRole, DefaultAdministratorRole, DefaultAmigoAdministratorRole, and DefaultSuperAdministratorRole. You can also define fully custom roles with arbitrary names.
Granular access controls for specific operations, expressed as Category:Action grants (for example, Conversation:CreateConversation) with optional conditions that limit when they apply. See Role-Based Permissions for the grant format.
Apply least privilege. Design roles with the narrowest allow grants that still cover the job, and scope almost every grant to the user's own organization. See Role-Based Permissions best practices.
Prefer temporary grants for debugging. Request time-limited, per-conversation access instead of holding a broad role. See Temporary Permission Grants.
Audit permissions regularly. Review custom roles and active temporary grants (for example, with forge conversation list-access) so stale access does not accumulate.
Rotate API keys. API keys inherit their creator's permissions, so set expiration dates and rotate before expiry. See Authentication.
Last updated
Was this helpful?
Was this helpful?
