nCino User Permissions API

openapi: 3.2.0
info:
  title: nCino Mortgage User Permissions API
  description: API framework built from the ground up to be more a robust, forward thinking solution with tools to support our developer community
  version: '1.0'
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://api.ncinomortgage.com
  description: Production server
security:
- OAuth2: []
tags:
- name: User Permissions
  description: 'Endpoints for querying a user''s effective permissions, resolved across

    all of their assigned roles.'
paths:
  /users/{user_id}/permissions:
    get:
      tags:
      - User Permissions
      operationId: user_permissions-index
      parameters:
      - name: user_id
        description: User ID.
        required: true
        in: path
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPermissionPagination'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Returns the union of permissions across every role assigned to the user,

        deduplicated and sorted, as an array of permission key strings.'
      summary: 🚧 Retrieve all permissions held by a user, resolved across all assigned roles.
  /users/{user_id}/permissions/{permission_key}:
    get:
      tags:
      - User Permissions
      operationId: user_permissions-show
      parameters:
      - name: permission_key
        description: The permission key to check (e.g. "manage_users").
        required: true
        in: path
        schema:
          type: string
      - name: user_id
        description: User ID.
        required: true
        in: path
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPermissionGranted'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Returns +{ "granted": true }+ if the permission is held by any of the

        user''s assigned roles; +{ "granted": false }+ otherwise. Never 404s on

        the permission key itself — only on a missing user.'
      summary: 🚧 Check whether a user has a specific permission. (BETA)
components:
  schemas:
    AbstractModel:
      type: object
      properties:
        _self:
          type: string
          description: The model's resource link to itself.
        _type:
          type: string
          description: The model's type.
        _links:
          type: object
          description: A list of links for the model's associations.
      required:
      - _self
      - _type
      additionalProperties: false
    AbstractPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractCollection'
      - type: object
        properties:
          total_pages:
            type: integer
            description: The total number of pages in the collection.
          total:
            type: integer
            description: The total number of items in the collection.
        additionalProperties: false
    AbstractCollection:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          contents:
            type: array
            items:
              type: object
            description: The contents for the collection.
        required:
        - contents
        additionalProperties: false
    UserPermissionGranted:
      type: object
      properties:
        granted:
          type: boolean
          description: +true+ if the user has the permission across any assigned role, +false+ otherwise.
      required:
      - granted
      description: The result of checking whether a user holds a specific permission.
      additionalProperties: false
    UserPermissionPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractPagination'
      - type: object
        properties:
          contents:
            type: array
            items:
              $ref: '#/components/schemas/UserPermission'
        required:
        - contents
        additionalProperties: false
    Error:
      type: object
      properties:
        id:
          type: string
          description: A unique ID (useful as a reference when debugging an error with support)
        status:
          type: integer
          description: The HTTP status code
        title:
          type: string
          description: A generic title
        detail:
          type: string
          description: A detailed message
        _links:
          type: object
          description: A list of relevant links
      required:
      - id
      - status
      - title
      example:
        id: 123abc
        status: 400
        title: Generic title for the error
        detail: Detailed message for the error
        _links:
          resource: contextual resource if applicable
    UserPermission:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          key:
            type: string
            description: The permission's stable key.
        required:
        - key
        additionalProperties: false
      description: A permission key held by a user, resolved across all of their assigned roles.
    ErrorSet:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
      required:
      - errors
      example:
        errors:
        - id: 123abc
          status: 400
          title: Generic title for the error
          detail: Detailed message for the error
          _links:
            resource: contextual resource if applicable
  headers:
    ApiVersionResponseHeader:
      description: API version.
      schema:
        type: string
    ApiSupportedVersionsResponseHeader:
      description: API supported versions for endpoint.
      schema:
        type: string
  responses:
    UnauthorizedError:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    ForbiddenError:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    BadRequestError:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    NotFoundError:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
  parameters:
    ApiVersionHeader:
      name: X-Api-Version
      description: Specify API version, for example '1.0'. By default, the version configured in the company settings is used.
      required: false
      in: header
      schema:
        type: string
    Page:
      name: page
      description: The page to retrieve.
      required: false
      in: query
      schema:
        type: integer
    PageSize:
      name: page_size
      description: The number of records returned in each page.
      required: false
      in: query
      schema:
        type: integer
  securitySchemes:
    OAuth2:
      type: oauth2
      description: OAuth 2.0 Access Token (Default)
      flows:
        clientCredentials:
          tokenUrl: /oauth/token
          scopes: {}