Skip to main content

​
Overview

Each Tarefy user has granular permissions within their account, configured by the administrator. These permissions determine which API endpoints the JWT token can access. When a request is made to a protected endpoint, the API validates the token and:
  • Allows if the user has the required permission → 2xx response
  • Blocks otherwise → 403 Forbidden response

​
Discovering your permissions

To find out which permissions the authenticated token has, use:
The response includes a permissions field listing the permissions granted to the user. Use that array to decide client-side which features to enable before calling specific endpoints — avoiding unnecessary 403s.

​
Handling 403 in your integration

Even with prior checks, you may still receive 403 Forbidden (admin changes permissions, account switch, etc.). Handle it like:
The response body:

​
Permissions per endpoint

Every endpoint in the API Reference clearly states whether it requires a permission. Generally:
  • Read (GET) — requires reading the resource
  • Write (POST/PATCH/PUT) — requires editing the resource
  • Admin — requires a specific administrative permission
Available permissions are defined by the account administrator in the Tarefy app. For a user to gain access to a specific endpoint, the administrator must grant the corresponding permission. See Errors for the full error pattern.