Users & Roles

Paylent provides role-based access control (RBAC) scoped to each environment. Define permissions, group them into roles, and assign roles to users.

Users

Users are scoped to an environment. Each user has:

• Email (unique within the environment)
• First and last name
• Password (Argon2 hashed)
• Email confirmation status

Creating Users

curl -X POST https://acme-test.paylent.com/api/users \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "user",
      "attributes": {
        "email": "[email protected]",
        "first_name": "Jane",
        "last_name": "Doe",
        "password": "secure_password",
        "password_confirmation": "secure_password"
      }
    }
  }'

Permissions

Permissions follow a resource:action naming convention:

Permission	Description
users:create	Create user accounts
users:read	View user details
users:update	Update user profiles
roles:create	Create roles
roles:read	View roles
clients:read	View OAuth clients
clients:create	Register OAuth clients

Permissions are defined per environment and can be customized for your application’s needs.

Roles

Roles are named groups of permissions. Common patterns:

• Admin — Full access to all resources
• Viewer — Read-only access
• Developer — Manage clients and keys, read users

Creating a Role

curl -X POST https://acme-test.paylent.com/api/roles \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "role",
      "attributes": {
        "name": "Developer",
        "description": "Can manage OAuth clients and signing keys"
      }
    }
  }'

Assigning Permissions to a Role

curl -X POST https://acme-test.paylent.com/api/role-permissions \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "role_permission",
      "attributes": {},
      "relationships": {
        "role": { "data": { "type": "role", "id": "ROLE_ID" } },
        "permission": { "data": { "type": "permission", "id": "PERMISSION_ID" } }
      }
    }
  }'

Assigning Roles to Users

curl -X POST https://acme-test.paylent.com/api/user-roles \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "user_role",
      "attributes": {},
      "relationships": {
        "user": { "data": { "type": "user", "id": "USER_ID" } },
        "role": { "data": { "type": "role", "id": "ROLE_ID" } }
      }
    }
  }'

Platform Authorization (ReBAC)

Beyond environment-level RBAC, Paylent uses relationship-based access control for platform-level authorization. This controls which dashboard users can manage which environments.

Two platform roles exist:

Relation	Access
admin	Full read/write/delete access to all resources in an environment
viewer	Read-only access to all resources in an environment

Platform authorization is managed automatically — account creators receive owner access, and environment-level tuples are created when environments are provisioned.