HOC Site

Object permissions

Permissions decide what the public, platform roles, and website user roles can do on an object type’s entries. Role checkboxes are RBAC (own vs others). Optional structured conditions on a grant further restrict matches (field compare or a time window such as younger than 30 minutes since created_at). Empty conditions keep the checkbox-only behavior. GET list and GET detail enforce the same helper as the admin UI.

Access

Operations

GET

Read the current permission matrix.

GET /api/v1/en/{websiteId}/objects/{objectTypeId}/permissions

PUT

Replace permissions. Role slices typically require website superadmin.

PUT /api/v1/en/{websiteId}/objects/{objectTypeId}/permissions

Use the following request body shape:

{
  "public": {},
  "platformRoles": [{ "id": "string", "objectType": {} }],
  "websiteUserRoles": [{ "id": "string", "objectType": {} }]
}

MCP

MCP: get_object_permissions, update_object_permissions.