Guides
Users and permissions
Configure roles and authorize resource access.
Define resource roles
Configure roles through /nb-admin/roles/. Use canonical resource permissions:
| Permission | Allows |
|---|---|
view-events |
Read events |
create-events |
Create events |
edit-events |
Update events |
delete-events |
Delete individual events |
manage-events |
Resource management |
Add view-nimblybar for the editor navigation and edit-inline-content for inline editing. Media access has its own permissions. Grant only the capabilities a role needs.
Authorize at boundaries
Validate dynamic route input, then check the required access before exposing protected data or accepting a protected action. Use the existing access library and router functions; custom API handlers call api_access() and scope the operation to the signed-in user where required.
A template hiding a button is not authorization for the backend operation.
API users
External integrations authenticate as users with API access enabled. Give each integration its own restricted role. A read-only event integration needs view-events; publication filtering and user-specific scoping remain explicit concerns.
Collection deletion has a separate permission, api_delete_resource_events. Ordinary record-delete permission does not grant deletion of the entire resource. See API authorization.