Role-Based Access Control
Elydora grants capabilities to five predefined roles. Each API endpoint requires one capability.
Roles
org_owner
Full access, including organization settings, members, invitations, webhooks, and agent assignments. Assigned to the organization creator.
- Create, read, and update the organization
- Manage members and invitations
- Register, update, freeze, unfreeze, revoke, and delete agents
- Submit and read operations
- Query the audit log and create exports
- Manage webhooks
- Assign agents to users
security_admin
Manages members, agent lifecycle, webhooks, and assignments. Cannot create organizations.
- Read and update the organization
- Manage members and invitations
- Register, update, freeze, unfreeze, revoke, and delete agents
- Submit and read operations
- Query the audit log and create exports
- Manage webhooks
- Assign agents to users
compliance_auditor
Read access for compliance and legal teams.
- Read the organization, members, all agents, operations, and epochs
- Query the audit log and create exports
integration_engineer
Integrates agents and submits operations.
- Register and update agents
- Submit and read operations
- Read the organization, members, visible agents, and epochs
readonly_investigator
Read-only access to visible agents, operations, and epochs.
- Read the organization, members, visible agents, operations, and epochs
integration_engineer and readonly_investigator lack the read_all capability. Once any assignment exists in the organization, they see only the agents assigned to them.
Endpoint Roles
The table lists the roles that can call each endpoint.
| Endpoint | Roles |
|---|---|
| POST /api/auth/sign-up/email | Public |
| POST /api/auth/sign-in/email | Public |
| GET /api/auth/get-session | Public; returns null without a session |
| GET /v1/auth/me | Any authenticated user |
| POST /v1/auth/refresh | Any user presenting a session token |
| POST /v1/auth/token | Any user presenting a session token |
| POST /v1/auth/rotate | Any user presenting the current API token |
| GET /v1/onboarding/status | Any authenticated user |
| POST /v1/onboarding/personal | Any authenticated user |
| POST /v1/onboarding/organization | Any authenticated user |
| POST /v1/agents/register | org_owner, security_admin, integration_engineer |
| GET /v1/agents | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| GET /v1/agents/:agent_id | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| PATCH /v1/agents/:agent_id | org_owner, security_admin, integration_engineer |
| DELETE /v1/agents/:agent_id | org_owner, security_admin |
| POST /v1/agents/:agent_id/freeze | org_owner, security_admin |
| POST /v1/agents/:agent_id/unfreeze | org_owner, security_admin |
| POST /v1/agents/:agent_id/revoke | org_owner, security_admin |
| GET /v1/agents/:agent_id/assignments | org_owner, security_admin |
| POST /v1/agents/:agent_id/assignments | org_owner, security_admin |
| DELETE /v1/agents/:agent_id/assignments/:user_id | org_owner, security_admin |
| POST /v1/operations | org_owner, security_admin, integration_engineer |
| GET /v1/operations/:operation_id | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| POST /v1/operations/:operation_id/verify | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| POST /v1/audit/query | org_owner, security_admin, compliance_auditor |
| GET /v1/admin/events | org_owner, security_admin, compliance_auditor |
| GET /v1/epochs | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| GET /v1/epochs/:epoch_id | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| POST /v1/exports | org_owner, security_admin, compliance_auditor |
| GET /v1/exports | org_owner, security_admin, compliance_auditor |
| GET /v1/exports/:export_id | org_owner, security_admin, compliance_auditor |
| GET /v1/exports/:export_id/download | org_owner, security_admin, compliance_auditor |
| GET /v1/members | org_owner, security_admin, compliance_auditor, integration_engineer, readonly_investigator |
| GET /v1/members/invitations | org_owner, security_admin |
| GET /v1/members/:user_id/agents | The user themselves, org_owner, or security_admin |
| GET /v1/webhooks | org_owner, security_admin |
| POST /v1/webhooks | org_owner, security_admin |
| DELETE /v1/webhooks/:webhook_id | org_owner, security_admin |
| GET /.well-known/elydora/jwks.json | Public |
| GET /v1/health | Public |
| GET /v1/health/deep | Public |