nCino Permissions API

openapi: 3.2.0
info:
  title: nCino Mortgage Permissions API
  description: API framework built from the ground up to be more a robust, forward thinking solution with tools to support our developer community
  version: '1.0'
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://api.ncinomortgage.com
  description: Production server
security:
- OAuth2: []
tags:
- name: Permissions
  description: Endpoints pertaining to permissions
paths:
  /permissions:
    get:
      tags:
      - Permissions
      operationId: permissions-index
      parameters:
      - name: group_key
        description: Filter <<glossary:permission>>s by category (group key).
        required: false
        in: query
        schema:
          type: string
      - name: name
        description: Filter <<glossary:permission>>s by name.
        required: false
        in: query
        schema:
          type: string
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionPagination'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Retrieve all permissions that can be granted to a role, optionally filtered by name or category.'
      summary: 🚧 Retrieve all permissions (BETA)
  /permissions/templates/{template_key}:
    get:
      tags:
      - Permissions
      operationId: permissions-show
      parameters:
      - name: template_key
        description: The identifier for the default role template.
        required: true
        in: path
        schema:
          type: string
          enum:
          - branch_admin
          - company_admin
          - loan_officer
          - region_admin
          - support_admin
          - team_member
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionTemplate'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Retrieve the permissions included in a given default role template.'
      summary: 🚧 Retrieve the permissions included in a given default role template (BETA)
components:
  responses:
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    NotFoundError:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    ForbiddenError:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    BadRequestError:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    UnauthorizedError:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
  headers:
    ApiVersionResponseHeader:
      description: API version.
      schema:
        type: string
    ApiSupportedVersionsResponseHeader:
      description: API supported versions for endpoint.
      schema:
        type: string
  parameters:
    Page:
      name: page
      description: The page to retrieve.
      required: false
      in: query
      schema:
        type: integer
    PageSize:
      name: page_size
      description: The number of records returned in each page.
      required: false
      in: query
      schema:
        type: integer
    ApiVersionHeader:
      name: X-Api-Version
      description: Specify API version, for example '1.0'. By default, the version configured in the company settings is used.
      required: false
      in: header
      schema:
        type: string
  schemas:
    AbstractPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractCollection'
      - type: object
        properties:
          total_pages:
            type: integer
            description: The total number of pages in the collection.
          total:
            type: integer
            description: The total number of items in the collection.
        additionalProperties: false
    AbstractCollection:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          contents:
            type: array
            items:
              type: object
            description: The contents for the collection.
        required:
        - contents
        additionalProperties: false
    PermissionTemplate:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          template_key:
            type: string
            description: The template identifier.
          permissions:
            type: array
            items:
              type: string
            description: Permission keys enabled in this template.
        required:
        - template_key
        - permissions
        additionalProperties: false
      description: The permissions included in a default role template.
    ErrorSet:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
      required:
      - errors
      example:
        errors:
        - id: 123abc
          status: 400
          title: Generic title for the error
          detail: Detailed message for the error
          _links:
            resource: contextual resource if applicable
    PermissionPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractPagination'
      - type: object
        properties:
          contents:
            type: array
            items:
              $ref: '#/components/schemas/Permission'
        required:
        - contents
        additionalProperties: false
    Permission:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          key:
            type: string
            description: The permission's stable key — the external identifier used when granting it to a <<glossary:role>>.
          description:
            type:
            - string
            - 'null'
            description: Human-readable description of what the permission allows.
          group_key:
            type: string
            description: The category (permission group) the permission belongs to.
          dependents:
            type: array
            items:
              type: string
            description: Keys of dependent <<glossary:permission>>s that are only meaningful when this permission is granted. Only present when the permission has dependents.
        required:
        - key
        - description
        - group_key
        additionalProperties: false
      description: 'An available permission that can be granted to a <<glossary:role>>.


        Permission definitions are in-memory config objects (no DB record / guid),

        so this is a plain model keyed by its string `key` rather than a uuid-backed

        resource model.'
    Error:
      type: object
      properties:
        id:
          type: string
          description: A unique ID (useful as a reference when debugging an error with support)
        status:
          type: integer
          description: The HTTP status code
        title:
          type: string
          description: A generic title
        detail:
          type: string
          description: A detailed message
        _links:
          type: object
          description: A list of relevant links
      required:
      - id
      - status
      - title
      example:
        id: 123abc
        status: 400
        title: Generic title for the error
        detail: Detailed message for the error
        _links:
          resource: contextual resource if applicable
    AbstractModel:
      type: object
      properties:
        _self:
          type: string
          description: The model's resource link to itself.
        _type:
          type: string
          description: The model's type.
        _links:
          type: object
          description: A list of links for the model's associations.
      required:
      - _self
      - _type
      additionalProperties: false
  securitySchemes:
    OAuth2:
      type: oauth2
      description: OAuth 2.0 Access Token (Default)
      flows:
        clientCredentials:
          tokenUrl: /oauth/token
          scopes: {}