Permissions

Grants

API keys and OAuth-connected apps carry grants: a list of

{ "resource": "sales-invoices", "access": ["READ"], "divisions": [123456] }

resource is a resource name or *; access contains READ, WRITE and/or DELETE; divisions is a list of administration codes or *. Anything not granted is denied.

Each operation needs a fixed level: list and get need READ, create and update WRITE, delete DELETE. A read-only key can never change data, whatever it asks.

What every call checks, in order

1. The credential is valid, not revoked or expired, and (for keys) used from an allowed IP.
2. The organization has an active subscription (402 billing.inactive otherwise).
3. The grants cover the resource, the action and the administration (403 access.denied).
4. Exact Online is connected and the administration is enabled.

Every denial is written to the organization's audit log.

People and roles

Role	Can
Owner	everything, including billing and deleting the organization
Administrator	Exact connection, API keys, connected apps, cache, members (2FA required)
Member	use the dashboard, see usage
Viewer	read-only dashboard access

Only owners and administrators with two-factor authentication can create API keys or authorize apps.