RBAC

Creating an organization seeds the owner as system:super_adminand a built-in catalog: modules org, members,roles, and keys, each with CRUD permissions.

Members

curl https://org.zyneo.app/v1/members/invite \
  --header "X-Zyneo-Key: zyneo_key_test_…" \
  --header "Authorization: Bearer zyneo_sk_test_…" \
  --header "Content-Type: application/json" \
  --data '{"email":"dev@zyneo.app","role":"system:developer"}'

Assign with PATCH /v1/members/:id/roles and{ "primary_role": "stock-clerk" }. The last super admin cannot be removed.

Permissions

A permission is a catalog entry: module, actions (CRUD or custom), optional record limit, AI usage quota, and extra traits.

{
  "module": "inventory",
  "key": "inventory:products:create",
  "actions": ["create"],
  "limits": { "records": 10000 },
  "traits": { "requires_approval_above": 500 }
}

Custom roles

POST /v1/roles accepts permissions as catalog keys and optional from_template (a system role slug). System roles cannot be edited or deleted. A custom role still assigned to members returns role_in_use.