nCino

nCino User Permissions API

Endpoints for querying a user's effective permissions, resolved across all of their assigned roles.

GitHub OpenAPI

Operations 2

GET /users/{user_id}/permissions 🚧 Retrieve all permissions held by a user, resolved across all assigned roles. (BETA) #
GET /users/{user_id}/permissions/{permission_key} 🚧 Check whether a user has a specific permission. (BETA) #

Documentation

📖
Documentation
https://developer.ncinomortgage.com/mortgage/docs/getting-started
📖
APIReference
https://developer.ncinomortgage.com/mortgage/reference
📖
Authentication
https://developer.ncinomortgage.com/mortgage/docs/authentication-1
📖
Documentation
https://developer.ncinomortgage.com/mortgage/docs/webhooks
📖
Documentation
https://developer.ncino.com/e-vault/docs/getting-started
📖
APIReference
https://developer.ncino.com/e-vault/reference
📖
Authentication
https://developer.ncino.com/e-vault/docs/authentication

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/ncino/refs/heads/main/openapi/ncino-user-permissions-api-openapi.yml

Other Resources

🔗
Postman
https://api.ncinomortgage.com/developer_info/postman_collection/1.0
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/ncino/refs/heads/main/asyncapi/ncino-mortgage-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/ncino-user-permissions-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

ncino-user-permissions-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: nCino Mortgage User Permissions API
  description: API framework built from the ground up to be more a robust, forward thinking solution with tools to support our developer community
  version: '1.0'
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://api.ncinomortgage.com
  description: Production server
security:
- OAuth2: []
tags:
- name: User Permissions
  description: 'Endpoints for querying a user''s effective permissions, resolved across

    all of their assigned roles.'
paths:
  /users/{user_id}/permissions:
    get:
      tags:
      - User Permissions
      operationId: user_permissions-index
      parameters:
      - name: user_id
        description: User ID.
        required: true
        in: path
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/Page'
      - $ref: '#/components/parameters/PageSize'
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPermissionPagination'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Returns the union of permissions across every role assigned to the user,

        deduplicated and sorted, as an array of permission key strings.'
      summary: 🚧 Retrieve all permissions held by a user, resolved across all assigned roles. (BETA)
  /users/{user_id}/permissions/{permission_key}:
    get:
      tags:
      - User Permissions
      operationId: user_permissions-show
      parameters:
      - name: permission_key
        description: The permission key to check (e.g. "manage_users").
        required: true
        in: path
        schema:
          type: string
      - name: user_id
        description: User ID.
        required: true
        in: path
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/ApiVersionHeader'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPermissionGranted'
          headers:
            X-Api-Version:
              $ref: '#/components/headers/ApiVersionResponseHeader'
            X-Api-Supported-Versions:
              $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '500':
          $ref: '#/components/responses/InternalServerError'
      description: '> 🚧 Under construction

        > **This endpoint is in beta.** Functionality may change without notice, support is limited, and use in production is not recommended. Your feedback is appreciated.


        Returns +{ "granted": true }+ if the permission is held by any of the

        user''s assigned roles; +{ "granted": false }+ otherwise. Never 404s on

        the permission key itself — only on a missing user.'
      summary: 🚧 Check whether a user has a specific permission. (BETA)
components:
  parameters:
    Page:
      name: page
      description: The page to retrieve.
      required: false
      in: query
      schema:
        type: integer
    ApiVersionHeader:
      name: X-Api-Version
      description: Specify API version, for example '1.0'. By default, the version configured in the company settings is used.
      required: false
      in: header
      schema:
        type: string
    PageSize:
      name: page_size
      description: The number of records returned in each page.
      required: false
      in: query
      schema:
        type: integer
  headers:
    ApiVersionResponseHeader:
      description: API version.
      schema:
        type: string
    ApiSupportedVersionsResponseHeader:
      description: API supported versions for endpoint.
      schema:
        type: string
  schemas:
    ErrorSet:
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Error'
      required:
      - errors
      example:
        errors:
        - id: 123abc
          status: 400
          title: Generic title for the error
          detail: Detailed message for the error
          _links:
            resource: contextual resource if applicable
    UserPermissionPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractPagination'
      - type: object
        properties:
          contents:
            type: array
            items:
              $ref: '#/components/schemas/UserPermission'
        required:
        - contents
        additionalProperties: false
    UserPermissionGranted:
      type: object
      properties:
        granted:
          type: boolean
          description: +true+ if the user has the permission across any assigned role, +false+ otherwise.
      required:
      - granted
      description: The result of checking whether a user holds a specific permission.
      additionalProperties: false
    UserPermission:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          key:
            type: string
            description: The permission's stable key.
        required:
        - key
        additionalProperties: false
      description: A permission key held by a user, resolved across all of their assigned roles.
    AbstractModel:
      type: object
      properties:
        _self:
          type: string
          description: The model's resource link to itself.
        _type:
          type: string
          description: The model's type.
        _links:
          type: object
          description: A list of links for the model's associations.
      required:
      - _self
      - _type
      additionalProperties: false
    AbstractPagination:
      allOf:
      - $ref: '#/components/schemas/AbstractCollection'
      - type: object
        properties:
          total_pages:
            type: integer
            description: The total number of pages in the collection.
          total:
            type: integer
            description: The total number of items in the collection.
        additionalProperties: false
    AbstractCollection:
      allOf:
      - $ref: '#/components/schemas/AbstractModel'
      - type: object
        properties:
          contents:
            type: array
            items:
              type: object
            description: The contents for the collection.
        required:
        - contents
        additionalProperties: false
    Error:
      type: object
      properties:
        id:
          type: string
          description: A unique ID (useful as a reference when debugging an error with support)
        status:
          type: integer
          description: The HTTP status code
        title:
          type: string
          description: A generic title
        detail:
          type: string
          description: A detailed message
        _links:
          type: object
          description: A list of relevant links
      required:
      - id
      - status
      - title
      example:
        id: 123abc
        status: 400
        title: Generic title for the error
        detail: Detailed message for the error
        _links:
          resource: contextual resource if applicable
  responses:
    UnauthorizedError:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    BadRequestError:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    NotFoundError:
      description: Not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
    ForbiddenError:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorSet'
      headers:
        X-Api-Version:
          $ref: '#/components/headers/ApiVersionResponseHeader'
        X-Api-Supported-Versions:
          $ref: '#/components/headers/ApiSupportedVersionsResponseHeader'
  securitySchemes:
    OAuth2:
      type: oauth2
      description: OAuth 2.0 Access Token (Default)
      flows:
        clientCredentials:
          tokenUrl: /oauth/token
          scopes: {}