Staff Permissions

Staff with the Custom role can only do what their permissions allow. These are the same permissions an admin ticks in the SalaryBox app’s role grid.

List Available Permissions (GET /customer/v1/staff/permissions) returns this list live, with each permission’s section and what it also needs. Integrations should read it instead of hard-coding the table below.

Use these names with (shared rules for all write endpoints are on Writing Data):

• Set Staff Permissions (PUT /customer/v1/staff/{salarybox_id}/permissions) to give a Custom-role staff member exactly this set.
• Set Staff Role (PUT /customer/v1/staff/{salarybox_id}/role) to give a staff member the Custom role first.
• Fetch Single Staff (GET /customer/v1/staff/fetch-employee), whose permissions field shows the set a Custom-role staff member has now.

Rules

• Names are case-sensitive and must be written exactly as below. Any other name is refused with Unknown permission 'x'.
• An :edit permission needs its :view permission in the same request, and reimbursement_request:approve needs reimbursement_request:view. Otherwise the request is refused, e.g. 'staff_details:edit' also needs 'staff_details:view'.
• Setting permissions replaces the whole set, so send every permission the staff member should keep.

All permissions (36)