> ## Client identification
>
> Requests to this API should include a `Client-Platform` header alongside
> `Authorization`, identifying the application, tool, or model making the
> request. This is used for integration support and analytics.
>
> Use your model or tool name, for example `claude-code` or `chatgpt`.
>
> Example:
>
> ```bash
> curl https://api.salaryboxapp.com/... \
>   -H "Authorization: Api-Key <api-key>" \
>   -H "Client-Platform: claude-code"
> ```

# List Add-on Permissions

GET https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions

Returns, for each active staff member, whether they can currently use the Location Tracking and CRM add-ons.

- If your company does not currently have the add-on, everyone is `false`.
- If it was bought as an add-on, only staff an admin has switched on are `true`.
- On some older plans the feature is part of the plan, so everyone is `true`.

Every active staff member is listed, even when both values are `false`. Use Get Company Subscription to see which add-ons your company has.


Reference: https://docs.salarybox.in/api-reference/staff/addon-permissions-retrieve

## Authentication

- `Authorization` header (required) (prefixed with ` Api-Key   `) — Format: "Api-Key \{api-key}"

## Request

### Query parameters

- `salarybox_ids` (list of string, optional) — Repeatable. Limits the result to these staff members, for example `salarybox_ids=SBK7Q2M9TX&salarybox_ids=SBK3H8D1LP`.
- `page` (integer, optional) — Page number, starting at 1.
- `page_size` (integer, optional) — Results per page. Default and maximum 500.

## Response

### 200

- `message` (string, required)
- `status` (boolean, required)
- `data` (list of AddonPermission, required)
- `count` (integer, required) — Total number of matching staff across all pages.
- `prev` (string, required, nullable) — URL of the previous page, or `null` on the first page.
- `next` (string, required, nullable) — URL of the next page, or `null` on the last page.

## Types

### AddonPermission

- `salarybox_id` (string, required) — SalaryBox ID of the staff member.
- `location_tracking` (boolean, required) — `true` if this person can currently use Location Tracking, so their location can be tracked through the SalaryBox app: the company has the feature and, where it was bought as an add-on, it is switched on for them. `false` if the company does not currently have the feature, or it is not switched on for this person.
- `crm` (boolean, required) — `true` if this person can currently use CRM features (such as customer visits and tasks) in the SalaryBox app: the company has the feature and, where it was bought as an add-on, it is switched on for them. `false` if the company does not currently have the feature, or it is not switched on for this person.

## Examples

**Response**

```json
{
  "message": "Success",
  "status": true,
  "data": [
    {
      "salarybox_id": "SBK7Q2M9TX",
      "location_tracking": false,
      "crm": false
    },
    {
      "salarybox_id": "SBR4T8W2PL",
      "location_tracking": true,
      "crm": true
    },
    {
      "salarybox_id": "SBN6C1Y7UB",
      "location_tracking": true,
      "crm": false
    }
  ],
  "count": 3,
  "prev": null,
  "next": null
}
```

**SDK Code**

```python Example
import requests

url = "https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions"

headers = {"Authorization": "Api-Key  <apiKey>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript Example
const url = 'https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions';
const options = {method: 'GET', headers: {Authorization: 'Api-Key  <apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Api-Key  <apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Example
require 'uri'
require 'net/http'

url = URI("https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Api-Key  <apiKey>'

response = http.request(request)
puts response.read_body
```

```java Example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions")
  .header("Authorization", "Api-Key  <apiKey>")
  .asString();
```

```php Example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions', [
  'headers' => [
    'Authorization' => 'Api-Key  <apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Example
using RestSharp;

var client = new RestClient("https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Api-Key  <apiKey>");
IRestResponse response = client.Execute(request);
```

```swift Example
import Foundation

let headers = ["Authorization": "Api-Key  <apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.salaryboxapp.com/v2/customer/v1/staff/addon-permissions")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```